Sigma rule: Account Tampering - Suspicious Failed Logon Reasons

Rule

Title

Account Tampering - Suspicious Failed Logon Reasons

Status

test

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2017-02-19

Modified

2025-10-17

File

rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Log source

product

windows

service

security

Detection

selection_eid:
    EventID:
        - 4625
        - 4776
selection_status:
    - Status:
          - '0xC0000072'  # User logon to account disabled by administrator
          - '0xC000006F'  # User logon outside authorized hours
          - '0xC0000070'  # User logon from unauthorized workstation
          - '0xC0000413'  # Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine
          - '0xC000018C'  # The logon request failed because the trust relationship between the primary domain and the trusted domain failed
          - '0xC000015B'  # The user has not been granted the requested logon type (aka logon right) at this machine
    - SubStatus:
          - '0xC0000072'  # User logon to account disabled by administrator
          - '0xC000006F'  # User logon outside authorized hours
          - '0xC0000070'  # User logon from unauthorized workstation
          - '0xC0000413'  # Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine
          - '0xC000018C'  # The logon request failed because the trust relationship between the primary domain and the trusted domain failed
          - '0xC000015B'  # The user has not been granted the requested logon type (aka logon right) at this machine
filter:
    SubjectUserSid: 'S-1-0-0'
condition: all of selection_* and not filter

False positives (as the rule lists them)

• User using a disabled account

Tags

• attack.persistence
• attack.privilege-escalation
• attack.initial-access
• attack.stealth
• attack.t1078

MITRE ATT&CK ids this rule names

• T1078

References

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
• https://twitter.com/SBousseaden/status/1101431884540710913

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml