Valid Users Failing to Authenticate From Single Source Using Kerberos

 1title: Valid Users Failing to Authenticate From Single Source Using Kerberos
 2id: 5d1d946e-32e6-4d9a-a0dc-0ac022c7eb98
 3status: unsupported
 4description: Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.
 5references:
 6    - https://docs.splunk.com/Documentation/ESSOC/3.22.0/stories/UseCase#Active_directory_password_spraying
 7author: Mauricio Velazco, frack113
 8date: 2021/06/01
 9modified: 2023/03/13
10tags:
11    - attack.t1110.003
12    - attack.initial_access
13    - attack.privilege_escalation
14logsource:
15    product: windows
16    service: security
17detection:
18    selection:
19        EventID: 4771
20        Status: '0x18'
21    filter_computer:
22        TargetUserName|endswith: '$'
23    timeframe: 24h
24    condition: selection and not filter_computer | count(TargetUserName) by IpAddress > 10
25falsepositives:
26    - Vulnerability scanners
27    - Misconfigured systems
28    - Remote administration tools
29    - VPN terminators
30    - Multiuser systems like Citrix server farms
31level: medium