NTLM Brute Force with Common Workstation Names

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•34

This rule detects NTLM brute force attempts by identifying specific workstation names commonly used by NTLM brute-forcing tools. It looks for Event ID 8004 in the Microsoft-Windows-NTLM/Operational log, specifically when the 'WorkstationName' field matches a list of known tool-related or generic Windows names.