Windows Password Compromise

[Simple_Search]

Hey Ya'll -

Wanted to see if anyone has a simplified solution for locating potential password compromises in a Windows AD Environment. For example, in an Active Directory domain structure, when a user accidentally types their password in the username field and presses enter, the information is sent to the security log. The user will then see they failed their logon and then attempt to logon in again. The following SPL is what I can use to pull the events but is not the best method. I have a manual method where I can pass a token from 1 panel to another but would like an automated method.

index=wineventlog source="wineventlog:security" EventCode=4625 OR (EventCode=4624 Logon_Type=2)
|  eval Account = mvindex(Account_Name,1)  <- the default pulls the computer name, using 1 for user name
| transaction maxspan=1m startswith="EventCode=4625"  endswith="EventCode=4624"
| table _time host EventCode Account

* From the SPL above I would like to have the multivalue Account field from the table require no null fields for the Account name (1 field will be the compromised password, and the other will be the user name, sometimes no name will show with the 4625 event) and also require one of the multivalue account fields length be greater than 13

[VatsalJagani]

@Simple_Search - You could start here:

index=wineventlog source="wineventlog:security" (EventCode=4625 OR (EventCode=4624 Logon_Type=2))
| eval Account = mvindex(Account_Name, 1)
| transaction src maxspan=2m startswith="EventCode=4625" endswith="EventCode=4624"
| where isnotnull(Account) AND mvcount(Account) > 0 AND len(mvindex(Account, 1)) > 13

transaction might not be the best command to use, but this is your starting point.

I hope this helps!! Consider upvoting!!