Valid Users Failing to Authenticate From Single Source Using Kerberos
Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.
Sigma rule (View on GitHub)
1title: Valid Users Failing to Authenticate From Single Source Using Kerberos
2id: 5d1d946e-32e6-4d9a-a0dc-0ac022c7eb98
3status: unsupported
4description: Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.
5references:
6 - https://docs.splunk.com/Documentation/ESSOC/3.22.0/stories/UseCase#Active_directory_password_spraying
7author: Mauricio Velazco, frack113
8date: 2021/06/01
9modified: 2023/03/13
10tags:
11 - attack.t1110.003
12 - attack.initial_access
13 - attack.privilege_escalation
14logsource:
15 product: windows
16 service: security
17detection:
18 selection:
19 EventID: 4771
20 Status: '0x18'
21 filter_computer:
22 TargetUserName|endswith: '$'
23 timeframe: 24h
24 condition: selection and not filter_computer | count(TargetUserName) by IpAddress > 10
25falsepositives:
26 - Vulnerability scanners
27 - Misconfigured systems
28 - Remote administration tools
29 - VPN terminators
30 - Multiuser systems like Citrix server farms
31level: medium
References
-
Splunk Security Content Analytic Story All the Analytic Stories shipped to different Splunk products. Below is a breakdown by Category. Abuse Brand monitoring Detect and investigate activity that m...
Read More
Related rules
- Disabled Users Failing To Authenticate From Source Using Kerberos
- Invalid Users Failing To Authenticate From Single Source Using NTLM
- Invalid Users Failing To Authenticate From Source Using Kerberos
- Multiple Users Failing to Authenticate from Single Process
- Multiple Users Remotely Failing To Authenticate From Single Source