LoFP / a host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.

Techniques

• T1110
• T1110.003

Sample rules

Windows Multiple Users Remotely Failed To Authenticate From Host

• source: splunk
• technicques:
  • T1110.003
  • T1110

Description

The following analytic identifies a source host failing to authenticate against a remote host with 30 unique users. It leverages Windows Event 4625 with Logon Type 3, indicating remote authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information. This detection is crucial for real-time security monitoring and threat hunting.

Detection logic

`wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" 
| bucket span=5m _time 
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer 
| rename Computer as dest
| where unique_accounts > 30 
| `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter`

Windows Unusual Count Of Users Remotely Failed To Auth From Host

• source: splunk
• technicques:
  • T1110.003
  • T1110

Description

The following analytic identifies a source host failing to authenticate against a remote host with multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625 (failed logon attempts) and Logon Type 3 (remote authentication) to detect this behavior. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the network.

Detection logic

`wineventlog_security`  EventCode=4625 Logon_Type=3 IpAddress!="-" 
| bucket span=2m _time 
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer 
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer 
| eval upperBound=(comp_avg+comp_std*3) 
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) 
| search isOutlier=1 
| `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter`