Search for multiple login attempts from same IP

[anomalyfinder]

Hi,

I try to find out a way to search for login events(bruteforce)were the user comes from one IP address and tries multiple usernames within a set period of time. Do someone have any ideas?

[96nick · Accepted solution]

Hey, here's a search that was posted to GoSplunk that works pretty well. You may have to change it a bit to match your environment but the foundation is set.

sourcetype=windows EventCode=4625 OR EventCode=4624 
 | bin _time span=5m as minute 
 | rex "Security ID:\s*\w*\s*\w*\s*Account Name:\s*(?<username>.*)\s*Account Domain:" 
 | stats count(Keywords) as Attempts,
 count(eval(match(Keywords,"Audit Failure"))) as Failed,
 count(eval(match(Keywords,"Audit Success"))) as Success by minute username
 | where Failed>=4
 | stats dc(username) as Total by minute 
 | where Total>5

Here's the link to the GoSplunk query.

[kamlesh_vaghela]

@anomalyfinder 

Can you please share some sample events?

KV