sigmalowHunting

MSSQL Server Failed Logon

Detects failed logon attempts from clients to MSSQL server.

MITRE ATT&CK

credential-access

Detection Query

selection:
  Provider_Name|contains: MSSQL
  EventID: 18456
condition: selection

Author

Nasreddine Bencherchali (Nextron Systems), j4son

Created

2023-10-11

Data Sources

windowsapplication

Platforms

windows

References

Tags

attack.credential-accessattack.t1110

Raw Content

title: MSSQL Server Failed Logon
id: 218d2855-2bba-4f61-9c85-81d0ea63ac71
related:
    - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d
      type: similar
status: test
description: Detects failed logon attempts from clients to MSSQL server.
references:
    - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
    - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
author: Nasreddine Bencherchali (Nextron Systems), j4son
date: 2023-10-11
modified: 2024-06-26
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: windows
    service: application
    definition: 'Requirements: Must enable MSSQL authentication.'
detection:
    selection:
        Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
        EventID: 18456
    condition: selection
falsepositives:
    - This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them
level: low