Splunk unknown stable spl

Windows Unusual Count Of Users Failed To Auth Using Kerberos

The following analytic identifies a source endpoint failing to authenticate multiple valid users using the Kerberos protocol, potentially indicating a Password Spraying attack. It leverages Event 4771, which is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT) due to a wrong password (failure code 0x18). This detection uses statistical analysis, specifically the 3-sigma rule, to identify unusual authentication failures. If confirmed malicious, this activity could allow an attacker to gain initial access or elevate privileges within an Active Directory environment.

View Source

Detection Logic

`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
    BY _time, IpAddress
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
    BY IpAddress
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1
| `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`

False Positives

⚠ A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms.

Field Validations

Loading…

Comments (0)

Loading comments...