Detection: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM

Description

The following analytic identifies a source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. It leverages EventCode 4776 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access or privilege escalation, posing a significant threat to the Active Directory environment. This detection is focused on domain controllers.

Search

1 `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 
2| bucket span=2m _time 
3| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user by _time, Workstation 
4| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation 
5| eval upperBound=(comp_avg+comp_std*3) 
6| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) 
7| search isOutlier=1 
8| rename Workstation as src 
9|`windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
Windows Event Log Security 4776	Windows	'xmlwineventlog'	'XmlWinEventLog:Security'	N/A

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting Audit Credential Validation' within Account Logon` needs to be enabled.

Known False Positives

A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.

Associated Analytic Story

• Active Directory Password Spraying

• Volt Typhoon

Risk Based Analytics (RBA)

References

• https://attack.mitre.org/techniques/T1110/003/

• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation

• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2