Detection rules › Kusto Query Language

Excessive Windows Logon Failures

Source: upstream

'This query identifies user accounts which has over 50 Windows logon failures today and at least 33% of the count of logon failures over the previous 7 days.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Event coverage

Provider	Event ID	Title
Security-Auditing	4625	An account failed to log on.

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

 macro "(TimeGenerated >= ago(endtime))"

Stage 3: `where`

and
  AccountType eq "User"
  EventID eq "4625"

Stage 4: `where`

not
  IpAddress in ["127.0.0.1", "::1"]

Stage 5: `summarize`

Stage 6: `join`

Stage 7: `where`

and
  CountToday ge "countlimit"
   macro "(CountToday >= (coalesce(CountPrev7day, 0) * threshold))"

Stage 8: `extend`

Stage 9: `extend`

Stage 10: `project`

Stage 11: `summarize`

Stage 12: `sort`

Stage 13: `extend`

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

Stage	Field	Kind	Excluded values
1	`src_ip`	in	`127.0.0.1`, `::1`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`AccountType`	eq	`User`
`CountToday`	ge	`countlimit`
`EventID`	eq	`4625` corpus 6 (splunk 6)

Excessive Windows Logon Failures

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: join

Stage 7: where

Stage 8: extend

Stage 9: extend

Stage 10: project

Stage 11: summarize

Stage 12: sort

Stage 13: extend