Password Spray Search / Alert

[johann2017]

Hello! I am building an alert to detect potential password spraying (it is looking for 10 or more failed logons within the last 15 minutes, where the username is correct but the password is wrong).

It works well, however there is one issue. If the same user fails to login a lot then it will trigger the alert. I only want a failure to count if the usernames are different. For example, if one user fails to login 10 times it will NOT alert. If 10 different users fail to login once each then it would alert. Below is my syntax:

index=*-windows-logs EventCode=4625 signature="User name is correct but the password is wrong"
Account_Name!=*$
| stats count by src_ip
| where count > 10

[diogofgm · Accepted solution]

You are counting events by src_ip when what you want is distinct accounts by src_ip

Replace your "count" with "dc(Account_Name) AS distinct_accounts" and the correct the where to use this new field.

Something like this:

index=*-windows-logs EventCode=4625 signature="User name is correct but the password is wrong"
Account_Name!=*$
| stats dc(Account_Name) AS distinct_accounts by src_ip
| where distinct_accounts > 10

[johann2017]

Thank you @diogofgm this worked!