Account Tampering - Suspicious Failed Logon Reasons

Title: Account Tampering - Suspicious Failed Logon Reasons
Status: test
Description:This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
  -https://twitter.com/SBousseaden/status/1101431884540710913
Author: Florian Roth (Nextron Systems)
Date: 2017-02-19
modified:2025-10-17
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1078'

Logsource:

• product: windows
• service: security

Detection:
  selection_eid:
    EventID:
      -'4625'
      -'4776'

  selection_status:
    - Status:
      - '0xC0000072'
      - '0xC000006F'
      - '0xC0000070'
      - '0xC0000413'
      - '0xC000018C'
      - '0xC000015B'
    - SubStatus:
      - '0xC0000072'
      - '0xC000006F'
      - '0xC0000070'
      - '0xC0000413'
      - '0xC000018C'
      - '0xC000015B'
  filter:
    SubjectUserSid: 'S-1-0-0'
  condition:all of selection_* and not filter
Falsepositives:
  -User using a disabled account
Level: medium