Alerting

windows user ending in $

splunkcol
Builder

I have created a windows level brute force attack alert to alert me when X number of authentication failures occur in a 15 min interval.

sometimes I see an alert where the user is the same hostname but ends in the $ sign

I have searched the windows documentation but it is not completely clear to me, could someone give me their opinion on what it is, if it is relevant or a false positive.

splunkcol_0-1643220561002.png

 

tnx

Labels (2)
0 Karma
1 Solution

splunkcol
Builder

As there are divided opinions, I prefer that it be the client who decides

thanks to all

 

"Next we filter out the domains that we are expecting to see. Controversially, we are also ignoring accounts that end in a dollar sign, which will typically occur from server accounts. This is a problematic assumption, as there's nothing to keep attackers from using dollar sign usernames for their own purposes -- as you mature this detection, try to move away from this limitation."

splunkcol_0-1643381137431.png

https://docs.splunksecurityessentials.com/content-detail/user_login_local_credentials/

View solution in original post

splunkcol
Builder

As there are divided opinions, I prefer that it be the client who decides

thanks to all

 

"Next we filter out the domains that we are expecting to see. Controversially, we are also ignoring accounts that end in a dollar sign, which will typically occur from server accounts. This is a problematic assumption, as there's nothing to keep attackers from using dollar sign usernames for their own purposes -- as you mature this detection, try to move away from this limitation."

splunkcol_0-1643381137431.png

https://docs.splunksecurityessentials.com/content-detail/user_login_local_credentials/

PickleRick
SplunkTrust
SplunkTrust

In AD computer accounts end with dollar sign. So you probably have your computers named after primary users.

isoutamo
SplunkTrust
SplunkTrust

Or those could be a managed service accounts https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-manage...

In that case you probably should check those?

r. Ismo

richgalloway
SplunkTrust
SplunkTrust

AIUI, names ending with $ are system accounts and can be ignored.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...