Multiple remote access login failures

Query · wazuh

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

correlates · Wazuh if_matched_sid 64101 within 240s

Remote access login failure

Detection tier

Atomic IOCs

The whole rule is one thing the adversary controls: a domain, an IP, a file hash. It stops working the moment that value rotates. Collapses the pyramid's bottom three rungs, which structure cannot reliably tell apart. Hidden by default: useful for asking 'has anyone seen this?', misleading as a measure of coverage.

Network & Host Artifacts

A URI shape, a user-agent, a registry path. These are the marks left behind when the adversary's tooling runs. Survives the rotation of any single domain or hash; breaks when the tool is reconfigured.

Tools

Identifies the software rather than the traces of it. Most YARA rules sit here, as do Suricata rules keyed on a hardcoded user-agent. Costs the adversary a rebuild or a new tool.

TTPs

Describes the action rather than anything the adversary owns or used: a process spawning another, a sequence of events, a join across other detections. Survives a tool swap, and the rung worth comparing across sources.

Pending classification

A classifier read the rule and structure alone did not settle it. Every rule in the index has been examined and none is skipped, so these are held for a later pass rather than guessed at. A wrong rung is worse than none. Concentrated in the formats whose rules say least about what they key on.

Metadata

Source

Wazuh Core Ruleset

License

GPLv2

Severity

High

Status

Unknown

Query type

wazuh

Created

—

Modified

2024-03-07

Authored by

Wazuh Core Ruleset

Source ID

Upstream

ruleset/rules/0620-win-generic_rules.xml

Type

correlation

Platforms

windows

Multiple remote access login failures

Description

Query · wazuh

Rule dependencies

Depends on

Analyst notes