Detection rules › Splunk
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
The following analytic detects a single source endpoint failing to authenticate with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. It leverages Windows Security Event 4768, focusing on failure code 0x12, indicating revoked credentials. This activity is significant as it may indicate a Password Spraying attack targeting disabled accounts, a tactic used by adversaries to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access or privilege escalation within the Active Directory environment, posing a severe security risk.
Known false positives
- A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4768: A Kerberos authentication ticket (TGT) was requested. |
Rule body
name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
id: 98f22d82-9d62-11eb-9fcf-acde48001122
version: 12
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects a single source endpoint failing to authenticate with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. It leverages Windows Security Event 4768, focusing on failure code `0x12`, indicating revoked credentials. This activity is significant as it may indicate a Password Spraying attack targeting disabled accounts, a tactic used by adversaries to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access or privilege escalation within the Active Directory environment, posing a severe security risk.
data_source:
- Windows Event Log Security 4768
search: |-
`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
BY _time, IpAddress
| where unique_accounts > 30
| `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
references:
- https://attack.mitre.org/techniques/T1110/003/
finding:
title: Potential Kerberos based password spraying attack from $IpAddress$
entity:
field: user
type: user
score: 50
threat_objects:
- field: IpAddress
type: ip_address
analytic_story:
- Active Directory Password Spraying
- Active Directory Kerberos Attacks
- Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
- T1110.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
Stages and Predicates
Stage 1: search
`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
Stage 2: bucket
| bucket span=5m _time
Stage 3: stats
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
BY _time, IpAddress
Stage 4: where
| where unique_accounts > 30
Stage 5: search
| `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`
Indicators
These rows show field, operator, and value matches.