Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC

Alerts on Windows failed logon (4625) events matching a BlueKeep scanner PoC TargetUserName value.

FreeReviewedSigma · High · v5

Product: windows
Service: security
Author: Florian Roth (Nextron Systems), Adam Bradbury (idea) (SigmaHQ), DRL 1.1
Published: 2019-06-02
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows security events (EventID 4625) where TargetUserName is set to the specific value "AAAAAAA". A fixed, sentinel username is commonly used by proof-of-concept scanners to probe remote services before attempting further exploitation. Detection relies on auditing of failed logons in the Windows Security log and matching the exact event fields in those records.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange

Malicious Veeam CVE-2023-27532 Exploitation Enabling xp_cmdshell via VeeamHax (via process_creation)

Possible .NET Remoting Deserialisation Exploitation via REM Endpoint

Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)

Malicious WannaCry tasksche Execution from mssecsvc Service via process_creation

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Suspicious SysAidServer Child Processes via Java on Windows

Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC

Pivot detection · T1210 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-log-detects-4625-rdp-failure-pattern-from-scanner-poc-for-bluek-8400629e

title: Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC
id: d499b1d8-0329-47e3-bacb-71a6739fb3f4
status: test
description: This rule flags Windows security events (EventID 4625) where TargetUserName is set to the specific value "AAAAAAA". A fixed, sentinel username is commonly used by proof-of-concept scanners to probe remote services before attempting further exploitation. Detection relies on auditing of failed logons in the Windows Security log and matching the exact event fields in those records.
references:
  - https://twitter.com/AdamTheAnalyst/status/1134394070045003776
  - https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_security_exploit_cve_2019_0708_scanner_poc.yml
author: Florian Roth (Nextron Systems), Adam Bradbury (idea), Huntrule Team
date: 2019-06-02
modified: 2022-12-25
tags:
  - attack.lateral-movement
  - attack.t1210
  - car.2013-07-002
  - detection.emerging-threats
  - cve.2019-0708
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    TargetUserName: AAAAAAA
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 8400629e-79a9-4737-b387-5db940ab2367
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL