Suspicious Failed Logon Reasons
This rule detects suspicious failed logon attempts by monitoring specific uncommon error codes. These error codes indicate issues such as logons to disabled accounts, attempts outside authorized hours, from unauthorized workstations, or due to trust relationship failures or insufficient logon rights. Such failures can suggest an adversary attempting to bypass security controls or test account validity and permissions.
Sigma
