Detection: Detect Excessive Account Lockouts From Endpoint

Updated Date: 2024-11-13 ID: c026e3dd-7e18-4abb-8f41-929e836efe74 Author: David Dorsey, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects endpoints causing a high number of account lockouts within a short period. It leverages the Windows security event logs ingested into the Change datamodel, specifically under the Account_Management node, to identify and count lockout events. This activity is significant as it may indicate a brute-force attack or misconfigured system causing repeated authentication failures. If confirmed malicious, this behavior could lead to account lockouts, disrupting user access and potentially indicating an ongoing attack attempting to compromise user credentials.

1
2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where All_Changes.result="*lock*" by All_Changes.dest All_Changes.result 
3|`drop_dm_object_name("All_Changes")` 
4|`drop_dm_object_name("Account_Management")`
5| `security_content_ctime(firstTime)` 
6| `security_content_ctime(lastTime)` 
7| search count > 5 
8| `detect_excessive_account_lockouts_from_endpoint_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
detect_excessive_account_lockouts_from_endpoint_filter search *
detect_excessive_account_lockouts_from_endpoint_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1078 Valid Accounts Defense Evasion
T1078.002 Domain Accounts Initial Access
Delivery
Exploitation
Installation
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

You must ingest your Windows security event logs in the Change datamodel under the nodename is Account_Management, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.\nSplunk>Phantom Playbook Integration If Splunk>Phantom is also configured in your environment, a Playbook called "Excessive Account Lockouts Enrichment and Response" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.\nPlaybook Link:https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/)

Known False Positives

It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Multiple accounts have been locked out. Review $dest$ and results related to $user$.

Risk Object Risk Object Type Risk Score Threat Objects
user user 36 No Threat Objects
dest system 36 No Threat Objects

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset WinEventLog:Security WinEventLog
Integration ✅ Passing Dataset WinEventLog:Security WinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 11