topic Correlation Search for brute force in Splunk Search

Correlation Search for brute force

toporagno — Thu, 11 Apr 2024 17:33:40 GMT

HI,

I need to upgrade my correlation search for Excessive Failed Logins with Username,

| tstats summariesonly=true values("Authentication.tag") as "tag",dc("Authentication.user") as "user_count",values("Authentication.user") as "usernames", dc("Authentication.dest") as "dest_count",count from datamodel="Authentication"."Authentication" where nodename="Authentication.Failed_Authentication" by "Authentication.app","Authentication.src" | rename "Authentication.app" as "app","Authentication.src" as "src" | where 'count'>=6

I would like the query to trigger only when there is a Successful Authentication after 6 failed authentication

thank youu

Re: Correlation Search for brute force

richgalloway — Thu, 11 Apr 2024 18:29:04 GMT

The current query can't do that because it only looks at failed logins. It will never see a successful login.

The solution will entail appending a tstats command that counts successes and then modifying the where command to look for 6 or more failures and at least 1 success.

You can find an example in the Basic Brute Force Detection use case in the Splunk Security Essentials apps.

Re: Correlation Search for brute force

gcusello — Fri, 12 Apr 2024 06:15:22 GMT

Hi @toporagno ,

as @richgalloway said, in Security Essentials App and in ES Content Updates App, there are many samples of the brute force attack followed by a saccessful login, anyway, you could ttry something like this:

| tstats summariesonly=true count(eval(Authentication.action="success")) AS success_count count(eval(Authentication.action="failure")) AS failure_count FROM datamodel=Authentication WHERE Authentication.action IN (success, failure) BY Authentication.user | rename Authentication.user AS user | where failure_count>=6 AND success_count>=6

That you can adapt to your data.

Ciao.

Giuseppe

Re: Correlation Search for brute force

PickleRick — Fri, 12 Apr 2024 08:45:39 GMT

Apart from all the valid remarks from @gcusello and @richgalloway , think about what you need. If you want to build on the search shown by @gcusello notice that yours groups login attempts by source (which means that it will show multiple attempts to log in using different usernames but from the same IP as one result) whereas the other one groups by username which means that it will aggregate login attempts to the same account launched from different IPs but split different account login attempts from the same IP as separate results. So it's a question of what you are looking for.