Group 1 – Authentication Anomalies

These detections focus on brute‐force, login, and account–related anomalies.

1. Detecting Brute Force Attacks

Identify multiple login attempts by an attacker using brute force (includes both Windows and Linux examples).

index=omar sourcetype=winxsecurity user=* user!=""| stats count(eval(action="success")) as successes, count(eval(action="failure")) as failures by user, ComputerName
| where successes>0 AND failures>100

index=omar source="WinEventLog:Security" EventCode=4625| bin _time span=5m| stats count by _time, user, host, src, action
| where count >= 5

index=omar source="/var/log/auth.log" "Failed password"| bin _time span=5m| stats count by _time, user, host, src, action
| where count >= 5

2. Alternate Brute Force Attack Detection

Identifies multiple failed login attempts from the same source IP using a simple threshold.

index=omar EventCode=4625| stats count by src_ip, user
| where count > 10| sort -count
| table src_ip, user, count

3. Detection of Brute Force Attacks on Web Applications

Identify repeated login attempts on web applications, which may indicate brute‐force attacks.

index=omar sourcetype=web_auth_logs
| stats count by user, src_ip
| where count > 10| sort -count
| table user, src_ip, count

4. Failed Admin Login Attempts

Spot multiple failed logins targeting privileged (admin) accounts.

index=omar sourcetype=windows EventCode=4625 user="admin*"| stats count by user, src_ip
| where count > 5| sort -count
| table user, src_ip, count

5. Unusual Account Lockouts

Monitor for frequent account lockouts which may be a sign of brute force attempts or misconfiguration.

index=omar sourcetype=auth_logs EventCode=4740| stats count by user, host
| where count > 3| table host, user, count

6. Suspicious Logon Pattern Detection

Detect users logging in from an unusually high number of distinct IP addresses, which might indicate compromised credentials.

index=omar sourcetype=auth_logs
| stats dc(src_ip) as unique_ips by user
| where unique_ips > 3| table user, unique_ips