topic Re: windows user ending in $ in Alerting

windows user ending in $

splunkcol — Wed, 26 Jan 2022 18:10:58 GMT

I have created a windows level brute force attack alert to alert me when X number of authentication failures occur in a 15 min interval.

sometimes I see an alert where the user is the same hostname but ends in the $ sign

I have searched the windows documentation but it is not completely clear to me, could someone give me their opinion on what it is, if it is relevant or a false positive.

tnx

Re: windows user ending in $

richgalloway — Wed, 26 Jan 2022 21:21:06 GMT

AIUI, names ending with $ are system accounts and can be ignored.

Re: windows user ending in $

PickleRick — Wed, 26 Jan 2022 22:01:28 GMT

In AD computer accounts end with dollar sign. So you probably have your computers named after primary users.

Re: windows user ending in $

isoutamo — Thu, 27 Jan 2022 18:39:42 GMT

Or those could be a managed service accounts https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

In that case you probably should check those?

r. Ismo

Re: windows user ending in $

splunkcol — Fri, 28 Jan 2022 14:47:53 GMT

As there are divided opinions, I prefer that it be the client who decides

thanks to all

"Next we filter out the domains that we are expecting to see. Controversially, we are also ignoring accounts that end in a dollar sign, which will typically occur from server accounts. This is a problematic assumption, as there's nothing to keep attackers from using dollar sign usernames for their own purposes -- as you mature this detection, try to move away from this limitation."

https://docs.splunksecurityessentials.com/content-detail/user_login_local_credentials/