Windows NTLM Brute Force via Common Spoofed WorkstationName Values

Alerts on NTLM EventID 8004 when WorkstationName equals common spoofed client names used in brute force attempts.

FreeUnreviewedSigmamediumv1

windows-ntlm-brute-force-via-common-spoofed-workstationname-values-9c8acf1a

title: Windows NTLM Brute Force via Common Spoofed WorkstationName Values
id: 846c61aa-7c8c-41c2-a84b-cf6e7f5bab8d
status: test
description: This rule flags NTLM authentication events where the WorkstationName matches a set of commonly spoofed device names associated with brute force tooling. Attackers may spoof workstation identifiers to evade simpler detections while performing repeated credential attempts over NTLM. The detection relies on Microsoft-Windows-NTLM/Operational events with EventID 8004 and the WorkstationName field being present and equal to one of the listed values.
references:
  - https://www.varonis.com/blog/investigate-ntlm-brute-force
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml
author: Jerry Shockley '@jsh0x', Huntrule Team
date: 2022-02-02
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: windows
  service: ntlm
  definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
  selection:
    EventID: 8004
  devicename:
    WorkstationName:
      - Rdesktop
      - Remmina
      - Freerdp
      - Windows7
      - Windows8
      - Windows2012
      - Windows2016
      - Windows2019
  condition: selection and devicename
falsepositives:
  - Systems with names equal to the spoofed ones used by the brute force tools
level: medium
license: DRL-1.1
related:
  - id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59
    type: derived

What it detects

This rule flags NTLM authentication events where the WorkstationName matches a set of commonly spoofed device names associated with brute force tooling. Attackers may spoof workstation identifiers to evade simpler detections while performing repeated credential attempts over NTLM. The detection relies on Microsoft-Windows-NTLM/Operational events with EventID 8004 and the WorkstationName field being present and equal to one of the listed values.

Known false positives

Systems with names equal to the spoofed ones used by the brute force tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.