Windows MSSQL Failed Logon (EventID 18456) From External Client IP

Alerts on MSSQL failed login attempts (Event 18456) from client IPs outside typical local/private ranges.

FreeReviewedSigma · Medium · v2

Product: windows
Service: application
Author: j4son (SigmaHQ), DRL 1.1
Published: 2023-10-11
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110Brute Force
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies MSSQL authentication failures by matching Windows application events with EventID 18456 and a Provider name containing "MSSQL". It flags failed logon attempts where the client address is not within the listed local/private IP ranges, which may indicate credential-guessing or brute-force activity against an externally reachable SQL endpoint. It relies on Windows application log events that include the Provider name, EventID, and client address field (Data).

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

Possible SonicWall Credential Testing via userLogin Endpoint

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

Suspicious JumpCloud Password Brute Force Followed by Success

AWS CloudTrail ConsoleLogin Failed authentication

Windows MSSQL Failed Logon (EventID 18456) From External Client IP

Pivot detection · T1110 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mssql-failed-logons-event-id-18456-from-external-client-ips-ebfe73c2

title: Windows MSSQL Failed Logon (EventID 18456) From External Client IP
id: 2d34e1fb-68ac-4f40-a001-b4c8186c3352
related:
  - id: 218d2855-2bba-4f61-9c85-81d0ea63ac71
    type: similar
  - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d
    type: derived
status: test
description: This rule identifies MSSQL authentication failures by matching Windows application events with EventID 18456 and a Provider name containing "MSSQL". It flags failed logon attempts where the client address is not within the listed local/private IP ranges, which may indicate credential-guessing or brute-force activity against an externally reachable SQL endpoint. It relies on Windows application log events that include the Provider name, EventID, and client address field (Data).
references:
  - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
  - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml
author: j4son, Huntrule Team
date: 2023-10-11
modified: 2025-05-28
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: windows
  service: application
  definition: "Requirements: Must enable MSSQL authentication."
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 18456
  filter_main_local_ips:
    Data|contains:
      - "CLIENT: 10."
      - "CLIENT: 172.16."
      - "CLIENT: 172.17."
      - "CLIENT: 172.18."
      - "CLIENT: 172.19."
      - "CLIENT: 172.20."
      - "CLIENT: 172.21."
      - "CLIENT: 172.22."
      - "CLIENT: 172.23."
      - "CLIENT: 172.24."
      - "CLIENT: 172.25."
      - "CLIENT: 172.26."
      - "CLIENT: 172.27."
      - "CLIENT: 172.28."
      - "CLIENT: 172.29."
      - "CLIENT: 172.30."
      - "CLIENT: 172.31."
      - "CLIENT: 192.168."
      - "CLIENT: 127."
      - "CLIENT: 169.254."
      - "CLIENT: <local machine>"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL