huntrule

Windows MSSQL Failed Logon (Event ID 18456) Detection

Alerts on MSSQL-related failed login attempts (Event ID 18456) captured in Windows application logs.

FreeReviewedSigma · Low · v2
Product
windows
Service
application
Author
Nasreddine Bencherchali (Nextron Systems), j4son (SigmaHQ), DRL 1.1
Published
2023-10-11
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Identifies failed authentication attempts to Microsoft SQL Server by matching Windows application events with EventID 18456 and a Provider_Name containing MSSQL. This behavior is important because repeated failed logons may indicate credential guessing, misconfiguration, or automated access attempts against database services. The detection relies on Windows application logging that records SQL Server authentication failures and on event fields for Provider_Name and EventID.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange
Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)
Malicious Brutforce Enumeration with Non Existing Users - Login (via security)
Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)
Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)
Malicious RDP Discovery Performed on Multiple Hosts (via rdp)
Possible SonicWall Credential Testing via userLogin Endpoint
Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)
Suspicious JumpCloud Password Brute Force Followed by Success
AWS CloudTrail ConsoleLogin Failed authentication
Windows MSSQL Failed Logon (Event ID 18456) Detection
Pivot detection · T1110 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.