topic Re: Search for multiple login attempts from same IP in Splunk Search

Search for multiple login attempts from same IP

anomalyfinder — Fri, 11 Jun 2021 13:13:14 GMT

Hi,

I try to find out a way to search for login events(bruteforce)were the user comes from one IP address and tries multiple usernames within a set period of time. Do someone have any ideas?

Re: Search for multiple login attempts from same IP

kamlesh_vaghela — Fri, 11 Jun 2021 13:19:30 GMT

@anomalyfinder

Can you please share some sample events?

Re: Search for multiple login attempts from same IP

96nick — Fri, 11 Jun 2021 13:26:40 GMT

Hey, here's a search that was posted to GoSplunk that works pretty well. You may have to change it a bit to match your environment but the foundation is set.

sourcetype=windows EventCode=4625 OR EventCode=4624 | bin _time span=5m as minute | rex "Security ID:\s*\w*\s*\w*\s*Account Name:\s*(?<username>.*)\s*Account Domain:" | stats count(Keywords) as Attempts, count(eval(match(Keywords,"Audit Failure"))) as Failed, count(eval(match(Keywords,"Audit Success"))) as Success by minute username | where Failed>=4 | stats dc(username) as Total by minute | where Total>5

Here's the link to the GoSplunk query.