topic Password Spray Search / Alert in Splunk Search

Password Spray Search / Alert

johann2017 — Mon, 22 Jun 2020 16:15:36 GMT

Hello! I am building an alert to detect potential password spraying (it is looking for 10 or more failed logons within the last 15 minutes, where the username is correct but the password is wrong).

It works well, however there is one issue. If the same user fails to login a lot then it will trigger the alert. I only want a failure to count if the usernames are different. For example, if one user fails to login 10 times it will NOT alert. If 10 different users fail to login once each then it would alert. Below is my syntax:

index=*-windows-logs EventCode=4625 signature="User name is correct but the password is wrong" Account_Name!=*$ | stats count by src_ip | where count > 10

Re: Password Spray Search / Alert

diogofgm — Mon, 22 Jun 2020 16:35:40 GMT

You are counting events by src_ip when what you want is distinct accounts by src_ip

Replace your "count" with "dc(Account_Name) AS distinct_accounts" and the correct the where to use this new field.

Something like this:

index=*-windows-logs EventCode=4625 signature="User name is correct but the password is wrong" Account_Name!=*$ | stats dc(Account_Name) AS distinct_accounts by src_ip | where distinct_accounts > 10

Re: Password Spray Search / Alert

johann2017 — Mon, 22 Jun 2020 19:23:30 GMT

Thank you @diogofgm this worked!