Alerting

windows user ending in $

splunkcol
Builder

I have created a windows level brute force attack alert to alert me when X number of authentication failures occur in a 15 min interval.

sometimes I see an alert where the user is the same hostname but ends in the $ sign

I have searched the windows documentation but it is not completely clear to me, could someone give me their opinion on what it is, if it is relevant or a false positive.

splunkcol_0-1643220561002.png

 

tnx

Labels (2)
0 Karma
1 Solution

splunkcol
Builder

As there are divided opinions, I prefer that it be the client who decides

thanks to all

 

"Next we filter out the domains that we are expecting to see. Controversially, we are also ignoring accounts that end in a dollar sign, which will typically occur from server accounts. This is a problematic assumption, as there's nothing to keep attackers from using dollar sign usernames for their own purposes -- as you mature this detection, try to move away from this limitation."

splunkcol_0-1643381137431.png

https://docs.splunksecurityessentials.com/content-detail/user_login_local_credentials/

View solution in original post

splunkcol
Builder

As there are divided opinions, I prefer that it be the client who decides

thanks to all

 

"Next we filter out the domains that we are expecting to see. Controversially, we are also ignoring accounts that end in a dollar sign, which will typically occur from server accounts. This is a problematic assumption, as there's nothing to keep attackers from using dollar sign usernames for their own purposes -- as you mature this detection, try to move away from this limitation."

splunkcol_0-1643381137431.png

https://docs.splunksecurityessentials.com/content-detail/user_login_local_credentials/

PickleRick
SplunkTrust
SplunkTrust

In AD computer accounts end with dollar sign. So you probably have your computers named after primary users.

isoutamo
SplunkTrust
SplunkTrust

Or those could be a managed service accounts https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-manage...

In that case you probably should check those?

r. Ismo

richgalloway
SplunkTrust
SplunkTrust

AIUI, names ending with $ are system accounts and can be ignored.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...