Failed Logon From Public IP

Title: Failed Logon From Public IP
Status: test
Description:Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
Author: NVISO
Date: 2020-05-06
modified:2024-03-11
Tags:

• -'attack.privilege-escalation'
• -'attack.initial-access'
• -'attack.persistence'
• -'attack.stealth'
• -'attack.t1078'
• -'attack.t1190'
• -'attack.t1133'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4625'
  filter_main_ip_unknown:
    IpAddress|contains: '-'
  filter_main_local_ranges:
    IpAddress|cidr:
      -'::1/128'
      -'10.0.0.0/8'
      -'127.0.0.0/8'
      -'172.16.0.0/12'
      -'192.168.0.0/16'
      -'169.254.0.0/16'
      -'fc00::/7'
      -'fe80::/10'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate logon attempts over the internet
  -IPv4-to-IPv6 mapped IPs
Level: medium