topic Identifying Authentication Irregularities in Splunk Search

Identifying Authentication Irregularities

ryangibson99 — Thu, 16 Jun 2011 16:30:44 GMT

I've been tasked with searching for authentication irregularities and I am fairly new to splunk. Authentication irregularities is fairly broad and so I am wondering if the splunk community has any suggestions! Thanks in advance. And if you were wondering, yes I have read the manual already.

Re: Identifying Authentication Irregularities

mw — Fri, 17 Jun 2011 01:26:50 GMT

Here are a couple of examples. Searches are sometimes specific to certain data or field extractions, so you probably won't get too many that will just work right off the bat for you, but these should give you some ideas.

For SSH logins: show me cases where there were at least 6 failed logins followed by a successful login (i.e. possible brute force login attack)

"failed password" OR "accepted password" | stats list(sshd_action) as list by host, user | eval list = mvjoin(list, " ") | eval alert = if(match(list, "Accepted (?:Failed\s?){6,}"), "True", "False") | where alert == "True"

Nice for a chart of the count of failed logins per user vs. the avg number of failed logins per user

(failed password) OR (logon failed) | stats count by user, host | eventstats avg(count) as avg | fields user, avg, count

Re: Identifying Authentication Irregularities

ryangibson99 — Fri, 17 Jun 2011 18:24:47 GMT

MW thanks so much, I am pretty new to Splunk this really helped.

Re: Identifying Authentication Irregularities

jwalzerpitt — Fri, 17 Apr 2015 17:04:39 GMT

MV,

Running the chart of the count of failed logins per user vs. the avg number of failed logins per user search query, but I'm getting the same output in the average column for every user. Is that correct?

I'm seeing the following:

USER AVG COUNT
UserA 1.208333 3

UserB 1.208333 2
UserC 1.208333 1
etc

Thx