admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

Browse Source
This commit is contained in:
Michael Haag
2021-05-11 14:17:38 -06:00
committed by GitHub
parent bf1b409919
commit ed333d33a8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
+1 -1
View File
@@ -11,7 +11,7 @@ description: 'The following analytic identifies one source endpoint failing to a
an adversary performing a Password Spraying attack against an Active Directory environment
using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when
the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code
0x18 stands for `wrong passowrd provided` (the attempted user is a legitimate domain user).\
0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\
The detection calculates the standard deviation for each host and leverages
the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic,