Author: Eric Zimmerman saericzimmerman@gmail.com and Andrew Rathbun
Description: Failed logon
EventId: 4625
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: UserName
    PropertyValue: "%domain%\\%user%"
    Values:
      -
        Name: domain
        Value: "/Event/EventData/Data[@Name=\"SubjectDomainName\"]"
      -
        Name: user
        Value: "/Event/EventData/Data[@Name=\"SubjectUserName\"]"
  -
    Property: RemoteHost
    PropertyValue: "%workstation% (%ipAddress%)"
    Values:
      -
        Name: ipAddress
        Value: "/Event/EventData/Data[@Name=\"IpAddress\"]"
      -
        Name: workstation
        Value: "/Event/EventData/Data[@Name=\"WorkstationName\"]"
  -
    Property: PayloadData1
    PropertyValue: "Target: %TargetDomainName%\\%TargetUserName%"
    Values:
      -
        Name: TargetDomainName
        Value: "/Event/EventData/Data[@Name=\"TargetDomainName\"]"
      -
        Name: TargetUserName
        Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
  -
    Property: PayloadData2
    PropertyValue: "LogonType %LogonType%"
    Values:
      -
        Name: LogonType
        Value: "/Event/EventData/Data[@Name=\"LogonType\"]"
  -
    Property: ExecutableInfo
    PropertyValue: "%ProcessName%"
    Values:
      -
        Name: ProcessName
        Value: "/Event/EventData/Data[@Name=\"ProcessName\"]"
  -
    Property: PayloadData3
    PropertyValue: "FailureReason1: %Status%"
    Values:
      -
        Name: Status
        Value: "/Event/EventData/Data[@Name=\"Status\"]"
  -
    Property: PayloadData4
    PropertyValue: "FailureReason2: %SubStatus%"
    Values:
      -
        Name: SubStatus
        Value: "/Event/EventData/Data[@Name=\"SubStatus\"]"

Lookups:
  -
    Name: Status
    Default: Unknown code
    Values:
      0xC000005E: there are currently no logon servers available to service the logon request
      0xC0000064: user name does not exist
      0xC000006A: user name is correct but the password is wrong
      0xC000006D: the cause is either a bad username or authentication information
      0xC000006E: referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions)
      0xC000006F: user logon outside authorized hours
      0xC0000070: user logon from unauthorized workstation
      0xC0000071: user logon with expired password
      0xC0000072: user logon to account disabled by administrator
      0xC00000DC: indicates the Sam Server was in the wrong state to perform the desired operation
      0xC0000133: clocks between DC and other computer too far out of sync
      0xC000015B: the user has not been granted the requested logon type (also called the logon right) at this machine
      0xC000018C: the logon request failed because the trust relationship between the primary domain and the trusted domain failed
      0xC0000192: an attempt was made to logon, but the Netlogon service was not started.
      0xC0000193: user logon with expired account
      0xC0000224: user is required to change password at next logon
      0xC0000225: evidently a bug in Windows and not a risk
      0xC0000234: user is currently locked out
      0xC00002EE: an error occurred during logon
      0xC0000413: logon failure , the machine you are logging on to is protected by an authentication firewall, the specified account is not allowed to authenticate to the machine
      0x0: Status OK
  -
    Name: SubStatus
    Default: Unknown code
    Values:
      0xC000005E: there are currently no logon servers available to service the logon request
      0xC0000064: user name does not exist
      0xC000006A: user name is correct but the password is wrong
      0xC000006D: the cause is either a bad username or authentication information
      0xC000006E: referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions)
      0xC000006F: user logon outside authorized hours
      0xC0000070: user logon from unauthorized workstation
      0xC0000071: user logon with expired password
      0xC0000072: user logon to account disabled by administrator
      0xC00000DC: indicates the Sam Server was in the wrong state to perform the desired operation
      0xC0000133: clocks between DC and other computer too far out of sync
      0xC000015B: the user has not been granted the requested logon type (also called the logon right) at this machine
      0xC000018C: the logon request failed because the trust relationship between the primary domain and the trusted domain failed
      0xC0000192: an attempt was made to logon, but the Netlogon service was not started.
      0xC0000193: user logon with expired account
      0xC0000224: user is required to change password at next logon
      0xC0000225: evidently a bug in Windows and not a risk
      0xC0000234: user is currently locked out
      0xC00002EE: an error occurred during logon
      0xC0000413: logon failure , the machine you are logging on to is protected by an authentication firewall, the specified account is not allowed to authenticate to the machine
      0x0: N/A

# Documentation:
# https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
# https://www.13cubed.com/downloads/rdp_flowchart.pdf
# https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/
# http://woshub.com/rdp-connection-logs-forensics-windows/
# https://countuponsecurity.com/2015/11/25/digital-forensics-supertimeline-event-logs-part-ii/
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
# https://frsecure.com/blog/rdp-connection-event-logs/
# https://www.socinvestigation.com/threat-hunting-using-windows-security-log/
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# Example Event Data:
#   <EventData>
#     <Data Name="SubjectUserSid">S-1-5-18</Data>
#     <Data Name="SubjectUserName">BASE-RD-01$</Data>
#     <Data Name="SubjectDomainName">shieldbase</Data>
#     <Data Name="SubjectLogonId">0x3E7</Data>
#     <Data Name="TargetUserSid">S-1-0-0</Data>
#     <Data Name="TargetUserName">-</Data>
#     <Data Name="TargetDomainName">-</Data>
#     <Data Name="Status">0xC0000073</Data>
#     <Data Name="FailureReason">%%2304</Data>
#     <Data Name="SubStatus">0xC0000073</Data>
#     <Data Name="LogonType">5</Data>
#     <Data Name="LogonProcessName">Advapi  </Data>
#     <Data Name="AuthenticationPackageName">Negotiate</Data>
#     <Data Name="WorkstationName">-</Data>
#     <Data Name="TransmittedServices">-</Data>
#     <Data Name="LmPackageName">-</Data>
#     <Data Name="KeyLength">0</Data>
#     <Data Name="ProcessId">0x3E8</Data>
#     <Data Name="ProcessName">C:\Windows\System32\svchost.exe</Data>
#     <Data Name="IpAddress">-</Data>
#     <Data Name="IpPort">-</Data>
#   </EventData>
