Detection rules › Splunk

Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos

Author
Mauricio Velazco, Splunk
Source
upstream

The following analytic identifies a source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. It leverages Event ID 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code 0x6, indicating the user is not found in the Kerberos database. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access and potential privilege escalation within the Active Directory environment.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110.003 Brute Force: Password Spraying

Event coverage

ProviderEvent IDTitle
Security-Auditing4768A Kerberos authentication ticket (TGT) was requested.

Stages and Predicates

Stage 1: search

search EventCode=4768 Status=0x6 TargetUserName!="*$"

Stage 2: bucket

bucket span=5m _time

Stage 3: stats

stats dc(TargetUserName) AS unique_accounts,AS user,AS dest BY _time, IpAddress

Stage 4: eventstats

eventstats avg(unique_accounts) AS comp_avg BY IpAddress

Stage 5: eval

eval ... using (comp_avg, comp_std)

Stage 6: eval

eval ... using (unique_accounts, upperBound)

Stage 7: search

search isOutlier=1

Stage 8: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4768 corpus 10 (splunk 10)
Statuseq
  • 0x6 corpus 3 (splunk 3)
TargetUserNamene
  • *$ corpus 10 (splunk 10)
isOutliereq
  • 1 corpus 16 (splunk 16)