Skip to content

Hide Navigation Hide TOC

Failed Logon From Public IP (f88e112a-21aa-44bd-9b01-6ee2a2bbbed1)

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Cluster A Galaxy A Cluster B Galaxy B Level
Exploit Public-Facing Application - T1190 (3f886f2a-874f-4333-b794-aa6075009b1c) Attack Pattern Failed Logon From Public IP (f88e112a-21aa-44bd-9b01-6ee2a2bbbed1) Sigma-Rules 1
Failed Logon From Public IP (f88e112a-21aa-44bd-9b01-6ee2a2bbbed1) Sigma-Rules Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) Attack Pattern 1
External Remote Services - T1133 (10d51417-ee35-4589-b1ff-b6df1c334e8d) Attack Pattern Failed Logon From Public IP (f88e112a-21aa-44bd-9b01-6ee2a2bbbed1) Sigma-Rules 1