Windows Failed Logons with Suspicious Status/ Substatus Codes (4625, 4776)

title: Windows Failed Logons with Suspicious Status/ Substatus Codes (4625, 4776)
id: fe163d05-6f0d-449f-b09b-6cadcfb13a2a
status: test
description: This rule flags Windows Security events for failed logons (EventID 4625 and 4776) when the failure Status and SubStatus match a set of specific, uncommon codes associated with account or authorization restrictions. Attackers may use these failures to probe account state (e.g., disabled accounts), validate access boundaries, or confirm whether authentication policies and trust relationships block logons. It relies on Windows Security audit telemetry that includes the Event IDs, Status, SubStatus, and SubjectUserSid fields, excluding anonymous/system SID traffic (S-1-0-0).
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
  - https://twitter.com/SBousseaden/status/1101431884540710913
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-19
modified: 2025-10-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  product: windows
  service: security
detection:
  selection_eid:
    EventID:
      - 4625
      - 4776
  selection_status:
    - Status:
        - "0xC0000072"
        - "0xC000006F"
        - "0xC0000070"
        - "0xC0000413"
        - "0xC000018C"
        - "0xC000015B"
    - SubStatus:
        - "0xC0000072"
        - "0xC000006F"
        - "0xC0000070"
        - "0xC0000413"
        - "0xC000018C"
        - "0xC000015B"
  filter:
    SubjectUserSid: S-1-0-0
  condition: all of selection_* and not filter
falsepositives:
  - User using a disabled account
level: medium
license: DRL-1.1
related:
  - id: 9eb99343-d336-4020-a3cd-67f3819e68ee
    type: derived