Insecure Or Cleartext Authentication Detected Rule

[maalyu1612]

Hi Team,

Rule "Insecure Or Cleartext Authentication Detected" detects says when Logon type "8" is detected in windows logs. 

As per Splunk :
Detects authentication requests that transmit the password over the network as cleartext (unencrypted)

https://docs.splunksecurityessentials.com/content-detail/insecure_or_cleartext_authentication_detect...

As Per Windows: 
The credentials do not traverse the network in plaintext (also called cleartext).

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

Could you please let us know why this difference in description, This is creating some challenges in understanding the logs.

Can someone help on this.

[Stefanie]

Logon Type 8 is generated when something was logged onto through the network using a cleartext password. 

That last sentence from the Microsoft Documentation  is a little confusing for me too. I had to read it a few times to understand what it was referencing.

During Network Logins, the Server that is being logged into has previously cashed those credentials. 

During authentication, hashes are created and sent to the Server are used to compare to what the computer has cached. 

This was done without utilizing SSL/TLS.