Windows MSSQL: Failed Logon (Event ID 18456) via Application Provider_Name

title: "Windows MSSQL: Failed Logon (Event ID 18456) via Application Provider_Name"
id: 06f77cb4-931b-4a87-af45-f84de42c222a
related:
  - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d
    type: similar
  - id: 218d2855-2bba-4f61-9c85-81d0ea63ac71
    type: derived
status: test
description: This rule flags MSSQL-related failed authentication attempts recorded in Windows application logs using Event ID 18456. Attackers often trigger repeated login failures when guessing credentials or probing for valid account access, making these events useful for early credential-access monitoring. It relies on application telemetry that includes the MSSQL provider name and the Event ID for failed logons.
references:
  - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
  - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml
author: Nasreddine Bencherchali (Nextron Systems), j4son, Huntrule Team
date: 2023-10-11
modified: 2024-06-26
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: windows
  service: application
  definition: "Requirements: Must enable MSSQL authentication."
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 18456
  condition: selection
falsepositives:
  - This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them
level: low
license: DRL-1.1