ID | Technique | Tactic |
---|---|---|
T1078 | Valid Accounts | Defense Evasion |
T1078.002 | Domain Accounts | Initial Access |
Detection: Detect Excessive Account Lockouts From Endpoint
Description
The following analytic detects endpoints causing a high number of account lockouts within a short period. It leverages the Windows security event logs ingested into the Change
datamodel, specifically under the Account_Management
node, to identify and count lockout events. This activity is significant as it may indicate a brute-force attack or misconfigured system causing repeated authentication failures. If confirmed malicious, this behavior could lead to account lockouts, disrupting user access and potentially indicating an ongoing attack attempting to compromise user credentials.
Search
1
2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where All_Changes.result="*lock*" by All_Changes.dest All_Changes.result
3|`drop_dm_object_name("All_Changes")`
4|`drop_dm_object_name("Account_Management")`
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| search count > 5
8| `detect_excessive_account_lockouts_from_endpoint_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
detect_excessive_account_lockouts_from_endpoint_filter | search * |
detect_excessive_account_lockouts_from_endpoint_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
You must ingest your Windows security event logs in the Change
datamodel under the nodename is Account_Management
, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.
Splunk>Phantom Playbook Integration If Splunk>Phantom is also configured in your environment, a Playbook called "Excessive Account Lockouts Enrichment and Response" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/
, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
Playbook Link:https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/
)
Known False Positives
It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Multiple accounts have been locked out. Review $dest$ and results related to $user$. | 36 | 60 | 60 |
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | WinEventLog:Security |
WinEventLog |
Integration | ✅ Passing | Dataset | WinEventLog:Security |
WinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 9