Update and rename custom-scenarios.yaml to windows-username-filter.yaml

2025-03-04 21:16:52 +00:00
parent 780cfe94d8
commit 9da38e0526
1 changed files with 0 additions and 19 deletions
@@ -0,0 +1,16 @@
+type: trigger
+name: custom/forbidden-usernames
+description: "Block IPs attempting RDP logins with forbidden usernames"
+filter: "evt.Parsed.username != '' && Lower(evt.Parsed.username) in ['administrator', 'admin', 'guest']"
+#blackhole: 2m
+groupby: evt.Meta.source_ip
+reprocess: true
+labels:
+  confidence: 3
+  spoofable: 0
+  classification:
+    - attack.T1110
+  behavior: "windows:bruteforce"
+  label: "Windows Bruteforce Username"
+  remediation: true
+  service: windows