Windows MSSQL Failed Logons (Event ID 18456) From External Client IPs

title: Windows MSSQL Failed Logons (Event ID 18456) From External Client IPs
id: 2d34e1fb-68ac-4f40-a001-b4c8186c3352
related:
  - id: 218d2855-2bba-4f61-9c85-81d0ea63ac71
    type: similar
  - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d
    type: derived
status: test
description: This rule flags MSSQL authentication failures by matching Windows application events with Event ID 18456 where the provider name contains 'MSSQL'. It excludes client addresses that match common local/private ranges, so only failed logons from non-local networks are reported. Repeated failures from external sources can indicate credential guessing or brute-force attempts against an MSSQL server, relying on application event telemetry that includes the Provider_Name and client address data fields.
references:
  - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
  - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml
author: j4son, Huntrule Team
date: 2023-10-11
modified: 2025-05-28
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: windows
  service: application
  definition: "Requirements: Must enable MSSQL authentication."
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 18456
  filter_main_local_ips:
    Data|contains:
      - "CLIENT: 10."
      - "CLIENT: 172.16."
      - "CLIENT: 172.17."
      - "CLIENT: 172.18."
      - "CLIENT: 172.19."
      - "CLIENT: 172.20."
      - "CLIENT: 172.21."
      - "CLIENT: 172.22."
      - "CLIENT: 172.23."
      - "CLIENT: 172.24."
      - "CLIENT: 172.25."
      - "CLIENT: 172.26."
      - "CLIENT: 172.27."
      - "CLIENT: 172.28."
      - "CLIENT: 172.29."
      - "CLIENT: 172.30."
      - "CLIENT: 172.31."
      - "CLIENT: 192.168."
      - "CLIENT: 127."
      - "CLIENT: 169.254."
      - "CLIENT: <local machine>"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1