{
  "id": "windows-authentication",
  "name": "Windows Authentication",
  "description": "Anmelde-, Lockout-, Spray- und Kerberos/NTLM-Erkennungen.",
  "version": 1,
  "enabled": true,
  "rules": [
    {
      "id": "win-account-lockout",
      "title": "Account Lockout",
      "description": "Windows Security Event 4740.",
      "severity": "medium",
      "score": 5.5,
      "enabled": true,
      "kind": "event",
      "channels": ["Security"],
      "event_codes": [4740],
      "group_by": ["host", "user", "workstation"],
      "threshold": 1,
      "window_seconds": 600,
      "suppress_seconds": 900,
      "summary": "Account-Lockout: {user}; Caller {workstation}; DC/Host {host} ({count}×)",
      "tags": ["windows", "authentication", "lockout"],
      "mitre": []
    },
    {
      "id": "win-failed-logon-burst",
      "title": "Viele fehlgeschlagene Anmeldungen",
      "description": "Mindestens 20 Event-4625-Ereignisse für denselben Kontext in fünf Minuten.",
      "severity": "high",
      "score": 7.5,
      "enabled": true,
      "kind": "threshold",
      "channels": ["Security"],
      "event_codes": [4625],
      "group_by": ["host", "user", "source_ip"],
      "threshold": 20,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "{count} fehlgeschlagene Logons für {user} auf {host} von {source_ip}",
      "tags": ["windows", "authentication", "brute-force"],
      "mitre": ["T1110"]
    },
    {
      "id": "win-password-spray",
      "title": "Password Spray",
      "description": "Eine Source-IP versucht viele unterschiedliche Konten anzumelden.",
      "severity": "high",
      "score": 8.5,
      "enabled": true,
      "kind": "distinct",
      "channels": ["Security"],
      "event_codes": [4625],
      "conditions": [{"field": "source_ip", "operator": "exists"}, {"field": "target_user", "operator": "exists"}],
      "group_by": ["source_ip"],
      "threshold": 20,
      "distinct_field": "target_user",
      "distinct_threshold": 10,
      "window_seconds": 600,
      "suppress_seconds": 1800,
      "summary": "Password-Spray von {source_ip}: {count} Versuche gegen {distinct} Benutzer",
      "tags": ["windows", "authentication", "password-spray"],
      "mitre": ["T1110.003"]
    },
    {
      "id": "win-kerberos-preauth-burst",
      "title": "Kerberos Pre-Auth Fehler-Burst",
      "description": "Viele Event-4771-Ereignisse für denselben Benutzer oder Quellkontext.",
      "severity": "high",
      "score": 7.4,
      "enabled": true,
      "kind": "threshold",
      "channels": ["Security"],
      "event_codes": [4771],
      "group_by": ["host", "user", "source_ip"],
      "threshold": 15,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "{count} Kerberos Pre-Auth Fehler für {user} auf {host} von {source_ip}",
      "tags": ["windows", "kerberos", "authentication"],
      "mitre": ["T1110"]
    },
    {
      "id": "win-ntlm-auth-failure-burst",
      "title": "NTLM Authentifizierungsfehler-Burst",
      "description": "Viele Event-4776-Ereignisse im kurzen Zeitraum.",
      "severity": "high",
      "score": 7.2,
      "enabled": true,
      "kind": "threshold",
      "channels": ["Security"],
      "event_codes": [4776],
      "group_by": ["host", "user", "workstation"],
      "threshold": 15,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "{count} NTLM-Authentifizierungsfehler für {user} über {workstation}",
      "tags": ["windows", "ntlm", "authentication"],
      "mitre": ["T1110"]
    }
  ]
}