Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Multiple failed logins correlation issue - Windows Rule 18151 #355

Open
RHProficio opened this issue Apr 18, 2019 · 6 comments
Open

Multiple failed logins correlation issue - Windows Rule 18151 #355

RHProficio opened this issue Apr 18, 2019 · 6 comments
Assignees
@Lopuiz
Labels
decoders Decoders related issues question

Comments

@RHProficio
Copy link

RHProficio commented Apr 18, 2019 •
edited

We are wondering if there is a bug in Windows rule 18151.

<if_matched_sid>18108</if_matched_sid>
<same_user />
Windows: Multiple failed attempts to perform a privileged operation by the same user.
pci_dss_10.2.4,pci_dss_10.2.5,pci_dss_11.4,gdpr_IV_35.7.d,gdpr_IV_32.2,

The rule seems to correlate on this field
t data.dstuser |   | (no user)

We wonder if it should correlate on this field
data.account_name

In our example alert for a given agent/user, system1. The alert fields are parsed for this agent including the full log. There is one field called previous_output that appears to contain log information for a different agent/user, system2. The hostnames and data.account_name are different. So we are wondering why this previous_output data is related to the overall alert for system1. The only related field we see is data.dstuser which is (no user) in both cases, but otherwise the log data seems unrelated.

Please contact me through Slack and I can provide the entire alert detailed information.

Thanks!
@Lopuiz
Copy link
Contributor

Lopuiz commented May 2, 2019

Hi @RHProficio,
We have been testing the rule with some logs, it works with the user name as you have said. Can you paste your log to try to reproduce your exact use case? Also, could you give more details about your problem, please?

On Windows, at the time you have to log in to an account there is no user field yet, this means that our dstuser field will be empty. The account_name field is filled with the Windows account information, which is different from the user name. Tell us if this is your use case and some further information that we may know.

Best regards,
Eva

@Lopuiz Lopuiz self-assigned this May 2, 2019
@RHProficio
Copy link
Author

Hi Eva,
Yes, I can provide the specific information we collected. Can I communicate that information privately through Slack?

@Lopuiz
Copy link
Contributor

Lopuiz commented May 3, 2019

Hi,
yes, of course. My username in slack is Eva López
regards, Eva.

@Lopuiz Lopuiz added the question label May 7, 2019
@Lopuiz
Copy link
Contributor

Lopuiz commented May 14, 2019

Hello @RHProficio,
I'll close this issue. I hope you solved the problem. If not, you can communicate me your logs.
Also, you can reopen this issue or open a new one.
Kind regards, Eva.

@Lopuiz Lopuiz closed this as completed May 14, 2019
@shortstack
Copy link

@Lopuiz @RHProficio seeing the same issue, and wondering what the resolution was?

@Lopuiz Lopuiz reopened this Jun 3, 2019
@Lopuiz
Copy link
Contributor

Lopuiz commented Jun 3, 2019 •
edited

Hello @shortstack,

This may be due to the decoder. Could you give me more information about the Windows event to replicate your case?

Regards, Eva

@Lopuiz Lopuiz added the decoders Decoders related issues label Jun 3, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Lopuiz Lopuiz

Labels
decoders Decoders related issues question
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@shortstack @Lopuiz @RHProficio