LoFP
/
T1110.003
T1110.003
Title
Tags
a host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
t1110
T1110.003
endpoint
splunk
a host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
t1110
T1110.003
endpoint
splunk
a host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. if this detection triggers on a host other than a domain controller, the behavior could represent a password spraying attack against the host's local accounts.
t1110
T1110.003
endpoint
splunk
a host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
t1110
T1110.003
endpoint
splunk
a process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
t1110
T1110.003
endpoint
splunk
a single public ip address servicing multiple legitmate users may trigger this search. in addition, the threshold of 5 distinct users may be too low for your needs. you may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific ip adresses from triggering this search.
t1078
t1078.001
T1110.003
okta tenant
splunk
a source ip failing to authenticate with multiple users in a short period of time is not common legitimate behavior.
t1110
T1110.003
T1110.004
t1586
t1586.003
o365 tenant
okta tenant
splunk
a source ip failing to authenticate with multiple users is not a common for legitimate behavior.
t1110
T1110.003
T1110.004
t1586
t1586.003
azure active directory
splunk
a source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. possible false positive scenarios include systems where several users connect to like mail servers, identity providers, remote desktop services, citrix, etc.
t1110
T1110.003
endpoint
splunk
a user with successful authentication events from different ips may also represent the legitimate use of more than one device. filter as needed and/or customize the threshold to fit your environment.
t1110
t1110.001
T1110.003
T1535
t1586
aws account
azure tenant
splunk
an ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
t1110
T1110.003
T1110.004
aws account
splunk
details for the risk calculation algorithm used by identity protection are unknown and may be prone to false positives.
t1110
T1110.003
t1586
t1586.003
azure active directory
splunk
fidelity of this is high as it is okta threatinsight. filter and modify as needed.
t1078
t1078.001
T1110.003
T1110.004
infrastructure
splunk
no known false positives for this detection. please review this alert
t1110
T1110.003
T1110.004
t1586
t1586.003
google cloud platform tenant
splunk
no known false postives for this detection. please review this alert.
t1110
T1110.003
T1110.004
t1586
t1586.003
google cloud platform tenant
splunk
this detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of vpns or cloud services that rotate ip addresses. filter as needed.
t1110
T1110.003
T1110.004
t1586
t1586.003
azure tenant
o365 tenant
splunk