Windows Failed Logons From Public IP Addresses

title: Windows Failed Logons From Public IP Addresses
id: a8bf0054-cf4b-4933-b169-c3b52e5b46a2
status: test
description: This rule flags failed authentication attempts (Security Event ID 4625) where the source IP is not one of the recognized local/private or loopback ranges. Failed logons from public IPs can indicate probing or unauthorized access attempts that may precede further compromise. It relies on Windows Security audit telemetry for EventID 4625 and the reported IpAddress, excluding IPv4/IPv6 internal and link-local address ranges and filtering out hyphen placeholders.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml
author: NVISO, Huntrule Team
date: 2020-05-06
modified: 2024-03-11
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.t1190
  - attack.t1133
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
  filter_main_ip_unknown:
    IpAddress|contains: "-"
  filter_main_local_ranges:
    IpAddress|cidr:
      - ::1/128
      - 10.0.0.0/8
      - 127.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - fc00::/7
      - fe80::/10
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate logon attempts over the internet
  - IPv4-to-IPv6 mapped IPs
level: medium
license: DRL-1.1
related:
  - id: f88e112a-21aa-44bd-9b01-6ee2a2bbbed1
    type: derived