Sigma rule: MSSQL Server Failed Logon From External Network

Rule

Title

MSSQL Server Failed Logon From External Network

Status

test

Level

medium

Author

j4son

Date

2023-10-11

Modified

2025-05-28

File

rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

Log source

product

windows

service

application

definition

Requirements: Must enable MSSQL authentication.

Detection

selection:
    Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
    EventID: 18456
filter_main_local_ips:
    Data|contains:
        - 'CLIENT: 10.' # filter_range_IP: 10.0.0.0/8
        - 'CLIENT: 172.16.' # filter_range_IP: 172.16.0.0/12
        - 'CLIENT: 172.17.'
        - 'CLIENT: 172.18.'
        - 'CLIENT: 172.19.'
        - 'CLIENT: 172.20.'
        - 'CLIENT: 172.21.'
        - 'CLIENT: 172.22.'
        - 'CLIENT: 172.23.'
        - 'CLIENT: 172.24.'
        - 'CLIENT: 172.25.'
        - 'CLIENT: 172.26.'
        - 'CLIENT: 172.27.'
        - 'CLIENT: 172.28.'
        - 'CLIENT: 172.29.'
        - 'CLIENT: 172.30.'
        - 'CLIENT: 172.31.'
        - 'CLIENT: 192.168.' # filter_range_IP: 192.168.0.0/16
        - 'CLIENT: 127.' # filter_loop_back: 127.0.0.0/8
        - 'CLIENT: 169.254.' # fileter_link-local_addressing: 169.254.0.0/16
        - 'CLIENT: <local machine>'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1110

MITRE ATT&CK ids this rule names

• T1110

Related rules

• 218d2855-2bba-4f61-9c85-81d0ea63ac71 (similar)

References

• https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
• https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml