huntrule

Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC

Alerts on Windows failed logon (4625) events matching a BlueKeep scanner PoC TargetUserName value.

FreeReviewedSigma · High · v5
Product
windows
Service
security
Author
Florian Roth (Nextron Systems), Adam Bradbury (idea) (SigmaHQ), DRL 1.1
Published
2019-06-02
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows security events (EventID 4625) where TargetUserName is set to the specific value "AAAAAAA". A fixed, sentinel username is commonly used by proof-of-concept scanners to probe remote services before attempting further exploitation. Detection relies on auditing of failed logons in the Windows Security log and matching the exact event fields in those records.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange
Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)
Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests
Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters
Suspicious SysAidServer Child Processes via Java on Windows
Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe
Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation
Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)
Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host
Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC
Pivot detection · T1210 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.