Detection: Cisco ASA - User Account Lockout Threshold Exceeded

Updated Date: 2025-11-18 ID: 3e8f9c2a-6d4b-4a7e-9c5f-1b8d7e3a9f2c Author: Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects user account lockouts on Cisco ASA devices resulting from excessive failed authentication attempts. Account lockouts may indicate brute force attacks, password spraying campaigns, credential stuffing attempts using compromised credentials from external breaches, or misconfigured automation attempting authentication with incorrect credentials. These activities represent attempts to gain unauthorized access to network infrastructure. The detection monitors for ASA message ID 113006, which is generated when a user account is locked out after exceeding the configured maximum number of failed authentication attempts, capturing the locked account name and the failure threshold that was exceeded. Investigate account lockouts for privileged or administrative accounts, multiple simultaneous lockouts affecting different accounts (suggesting password spraying), lockouts originating from unusual source IP addresses, lockouts during off-hours, or patterns suggesting automated attack tools.

Search

 1`cisco_asa`
 2message_id IN (113006)
 3
 4| rex "locked out on exceeding '(?<attempts_count>\d+)' successive failed authentication attempts"
 5
 6| rex "User '(?<user>[^']+)' locked out"
 7
 8| eval failure_description="locked out on exceeding " . attempts_count . " successive failed authentication attempts"
 9
10| fillnull
11
12| stats earliest(_time) as firstTime
13        latest(_time) as lastTime
14        values(message_id) as message_id
15        values(failure_description) as failure_description
16  by host user
17
18| `security_content_ctime(firstTime)`
19
20| `security_content_ctime(lastTime)`
21
22| `cisco_asa___user_account_lockout_threshold_exceeded_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco ASA Logs	Other	`'cisco:asa'`	`'not_applicable'`

Macros Used

Name	Value
cisco_asa	`sourcetype=cisco:asa`
cisco_asa___user_account_lockout_threshold_exceeded_filter	`search *`

cisco_asa___user_account_lockout_threshold_exceeded_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1110.001	Password Guessing	Credential Access
T1110.003	Password Spraying	Credential Access

Exploitation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 113006. If your logging level is set to 'Informational' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 113006. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html. You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da

Known False Positives

Legitimate lockouts occur from forgotten passwords, typos, script misconfigurations, or connectivity issues. Verify against help desk tickets. Filter known accounts during business hours or establish baseline patterns.

Associated Analytic Story

Suspicious Cisco Adaptive Security Appliance Activity

Risk Based Analytics (RBA)

Risk Message:

User account $user$ was $failure_description$ on Cisco ASA host $host$.

Risk Object	Risk Object Type	Risk Score	Threat Objects
host	system	40	No Threat Objects
user	user	30	No Threat Objects

References

https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-101001-to-199021.html#con_4769446

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:asa`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:asa`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1