Detection: Detect Password Spray Attempts

 1
 2| tstats `security_content_summariesonly` values(Authentication.user) AS unique_user_names dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" NOT Authentication.src IN ("-","unknown") by Authentication.src, Authentication.action, Authentication.signature_id, sourcetype, _time span=5m  
 3| `drop_dm_object_name("Authentication")`
 4    ```fill out time buckets for 0-count events during entire search length```
 5
 6| appendpipe [
 7| timechart limit=0 span=5m count 
 8| table _time] 
 9| fillnull value=0 unique_accounts
10  ``` Create aggregation field & apply to all null events```
11
12| eval counter=src+"__"+sourcetype+"__"+signature_id  
13| eventstats values(counter) as fnscounter  
14| eval counter=coalesce(counter,fnscounter) 
15  ``` stats version of mvexpand ```
16
17| stats values(app) as app values(unique_user_names) as unique_user_names values(total_failures) as total_failures values(src) as src values(signature_id) as signature_id values(sourcetype) as sourcetype count by counter unique_accounts _time
18    ``` remove duplicate time buckets for each unique source```
19
20| sort - _time unique_accounts 
21| dedup _time counter
22    ```Find the outliers```
23
24| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter 
25| eval upperBound=(comp_avg+comp_std*3) 
26| eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) 
27| replace "::ffff:*" with * in src  
28| where isOutlier=1  
29| foreach * 
30    [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)] 
31
32| table _time, src, action, app, unique_accounts, unique_user_names, total_failures, sourcetype, signature_id, counter 
33| `detect_password_spray_attempts_filter`