Windows NTLM brute force targeting workstation/device names

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110Brute Force
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags NTLM authentication events (EventID 8004) where the workstation name matches a set of common tool-spoofed device names. Attackers often brute-force credentials by presenting predictable or reused workstation identifiers to their targets. The detection relies on Microsoft-Windows-NTLM/Operational telemetry, specifically the WorkstationName field captured with the NTLM event.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

Possible SonicWall Credential Testing via userLogin Endpoint

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

Suspicious JumpCloud Password Brute Force Followed by Success

AWS CloudTrail ConsoleLogin Failed authentication

Windows NTLM brute force targeting workstation/device names

Pivot detection · T1110 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-ntlm-brute-force-via-common-spoofed-workstationname-values-9c8acf1a

title: Windows NTLM brute force targeting workstation/device names
id: 846c61aa-7c8c-41c2-a84b-cf6e7f5bab8d
status: test
description: This rule flags NTLM authentication events (EventID 8004) where the workstation name matches a set of common tool-spoofed device names. Attackers often brute-force credentials by presenting predictable or reused workstation identifiers to their targets. The detection relies on Microsoft-Windows-NTLM/Operational telemetry, specifically the WorkstationName field captured with the NTLM event.
references:
  - https://www.varonis.com/blog/investigate-ntlm-brute-force
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml
author: Jerry Shockley '@jsh0x', Huntrule Team
date: 2022-02-02
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: windows
  service: ntlm
  definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
  selection:
    EventID: 8004
  devicename:
    WorkstationName:
      - Rdesktop
      - Remmina
      - Freerdp
      - Windows7
      - Windows8
      - Windows2012
      - Windows2016
      - Windows2019
  condition: selection and devicename
falsepositives:
  - Systems with names equal to the spoofed ones used by the brute force tools
level: medium
license: DRL-1.1
related:
  - id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL