Windows MSSQL Failed Logon (Event ID 18456) Detection

Alerts on MSSQL-related failed login attempts (Event ID 18456) captured in Windows application logs.

FreeReviewedSigma · Low · v2

Product: windows
Service: application
Author: Nasreddine Bencherchali (Nextron Systems), j4son (SigmaHQ), DRL 1.1
Published: 2023-10-11
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110Brute Force
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies failed authentication attempts to Microsoft SQL Server by matching Windows application events with EventID 18456 and a Provider_Name containing MSSQL. This behavior is important because repeated failed logons may indicate credential guessing, misconfiguration, or automated access attempts against database services. The detection relies on Windows application logging that records SQL Server authentication failures and on event fields for Provider_Name and EventID.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

Possible SonicWall Credential Testing via userLogin Endpoint

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

Suspicious JumpCloud Password Brute Force Followed by Success

AWS CloudTrail ConsoleLogin Failed authentication

Windows MSSQL Failed Logon (Event ID 18456) Detection

Pivot detection · T1110 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mssql-failed-logon-event-id-18456-via-application-provider-name-218d2855

title: Windows MSSQL Failed Logon (Event ID 18456) Detection
id: 06f77cb4-931b-4a87-af45-f84de42c222a
related:
  - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d
    type: similar
  - id: 218d2855-2bba-4f61-9c85-81d0ea63ac71
    type: derived
status: test
description: Identifies failed authentication attempts to Microsoft SQL Server by matching Windows application events with EventID 18456 and a Provider_Name containing MSSQL. This behavior is important because repeated failed logons may indicate credential guessing, misconfiguration, or automated access attempts against database services. The detection relies on Windows application logging that records SQL Server authentication failures and on event fields for Provider_Name and EventID.
references:
  - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
  - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml
author: Nasreddine Bencherchali (Nextron Systems), j4son, Huntrule Team
date: 2023-10-11
modified: 2024-06-26
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: windows
  service: application
  definition: "Requirements: Must enable MSSQL authentication."
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 18456
  condition: selection
falsepositives:
  - This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL