Name:Windows Multiple Users Remotely Failed To Authenticate From Host id:80f9d53e-9ca1-11eb-b0d6-acde48001122 version:8 date:2025-02-10 author:Mauricio Velazco, Splunk status:production type:TTP Description:The following analytic identifies a source host failing to authenticate against a remote host with 30 unique users. It leverages Windows Event 4625 with Logon Type 3, indicating remote authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information. This detection is crucial for real-time security monitoring and threat hunting. Data_source:
-Windows Event Log Security 4625
search:`wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest values(src) as src values(user) as user by _time, IpAddress, Computer, action, app, authentication_method, signature, signature_id | rename Computer as dest | where unique_accounts > 30 | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter`
how_to_implement:To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. known_false_positives:A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. References: -https://attack.mitre.org/techniques/T1110/003/ -https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 -https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 -https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Active Directory Password Spraying' - 'Volt Typhoon' asset_type:Endpoint mitre_attack_id: - 'T1110.003' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' security_domain:endpoint
