[WINDOWS-SECURITY] Authentication - Anonymous NTLM V1 Logon After Brute Force

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Authentication - Anonymous NTLM V1 Logon After Brute Force"; program:Security; event_id:4624; content:"ANONYMOUS LOGON"; content:"NTLM V1"; content:"NtLmSsp"; classtype:credential-access; parse_src_ip:1; json_map:"dest_ip",".xff"; threshold:type suppress,track by_src&by_dst, count 1, seconds 3600; xbits: isset, ntlm_bruteforce, track ip_src; reference:url,attack.mitre.org/techniques/T1187/; metadata:createdOn 2026_06_16, updatedOn 2026_06_16; sid:5017962; rev:1;)