meta:
author = "XXX XXX"
description = "Detects a successful logon immediately following multiple failed logon attempts from the same IP or user, using specific Windows Event IDs."
severity = "High"
priority="High"
mitre = "T1110.001"
yara_version = "YL2.0"
tactic = "Credential Access"
technique = "Brute Force"
events:
// Event 1: Failed authentication attempts from Windows logs (4625).
$fail.metadata.event_type = "LOGIN_FAILED" and
$fail.principal.asset.ip = $ip_address and
$fail.target.user.userid = $user_id
// Event 2: A single successful authentication from the same IP (Windows 4624).
$success.metadata.event_type = "LOGIN_SUCCESS" and
$success.principal.asset.ip = $ip_address and
$success.target.user.userid = $user_id
match:
$ip_address, $user_id over 5m
outcome:
$failed_attempts = count($fail)
$alert_type = array_distinct("Successful Brute Force Attack via Event IDs 4624/4625")
condition:
$success and $fail and $failed_attempts >=3
}
ERROR:
-
validating intermediate representation: placeholder variable fail is not assigned to an event field or outcome valueline: 40 column: 31-35 LINE 40 = Outcome Not sure where Im making a mistake and what needs to be changed to run the rule, and this error is not letting me to save since there is a mistake