Detection: Detect Excessive Account Lockouts From Endpoint

Description

The following analytic detects endpoints causing a high number of account lockouts within a short period. It leverages the Windows security event logs ingested into the Change datamodel, specifically under the Account_Management node, to identify and count lockout events. This activity is significant as it may indicate a brute-force attack or misconfigured system causing repeated authentication failures. If confirmed malicious, this behavior could lead to account lockouts, disrupting user access and potentially indicating an ongoing attack attempting to compromise user credentials.

Search

1
2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where All_Changes.result="*lock*" by All_Changes.dest All_Changes.result 
3|`drop_dm_object_name("All_Changes")` 
4|`drop_dm_object_name("Account_Management")`
5| `security_content_ctime(firstTime)` 
6| `security_content_ctime(lastTime)` 
7| search count > 5 
8| `detect_excessive_account_lockouts_from_endpoint_filter`

Data Source

No data sources specified for this detection.

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

You must ingest your Windows security event logs in the Change datamodel under the nodename is Account_Management, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. Splunk>Phantom Playbook Integration If Splunk>Phantom is also configured in your environment, a Playbook called "Excessive Account Lockouts Enrichment and Response" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. Playbook Link:https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/)

Known False Positives

It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.

Associated Analytic Story

• Active Directory Password Spraying

Risk Based Analytics (RBA)

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 10