Detection rules › Splunk

Windows Multiple Users Failed To Authenticate From Host Using NTLM

Author
Mauricio Velazco, Splunk
Source
upstream

The following analytic identifies a single source endpoint failing to authenticate with 30 unique valid users using the NTLM protocol. It leverages EventCode 4776 from Domain Controller logs, focusing on error code 0xC000006A, which indicates a bad password. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access to sensitive information or further compromise of the Active Directory environment.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110.003 Brute Force: Password Spraying

Event coverage

ProviderEvent IDTitle
Security-Auditing4776The domain controller attempted to validate the credentials for an account.

Stages and Predicates

Stage 1: search

search EventCode=4776 Status=0xC000006A TargetUserName!="*$"

Stage 2: bucket

bucket span=5m _time

Stage 3: stats

stats dc(TargetUserName) AS unique_accounts,AS tried_accounts,AS dest BY _time, Workstation

Stage 4: where

where unique_accounts>30

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4776 corpus 4 (splunk 4)
Statuseq
  • 0xC000006A corpus 2 (splunk 2)
TargetUserNamene
  • *$ corpus 10 (splunk 10)
unique_accountsgt
  • 30 corpus 8 (splunk 8)