Potential Kerberos Pre-Authentication Failure for Machine Accounts
Detects Kerberos pre-authentication failures for machine accounts, which may indicate attempts to brute-force service account passwords. This rule helps identify potential Golden dMSA attacks where attackers try multiple password combinations. When hunting, look for multiple 4771 failures for machine accounts in short succession with status code 0x18 (KDC_ERR_PREAUTH_FAILED). Distinguish these from 0x19 (KDC_ERR_PREAUTH_REQUIRED), which indicates that additional pre-authentication is required rather than that a password was incorrect. Hypothesis: An attacker is attempting to identify machine accounts with weak passwords for attacks like Golden dMSA by performing Kerberos pre-authentication brute-force against machine accounts (ending with $). Multiple failures in a short time window from the same source IP or targeting multiple machine accounts suggests credential guessing activity.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
An attacker is attempting to identify machine accounts with weak passwords for attacks like Golden dMSA by performing Kerberos pre-authentication brute-force against machine accounts (ending with $). Multiple failures in a short time window from the same source IP or targeting multiple machine accounts suggests credential guessing activity.
detection:
selection:
EventID: 4771
TargetUserName|endswith: '$'
Status:
- '0x19' # KDC_ERR_PREAUTH_REQUIRED - additional pre-authentication is required
- '0x18' # KDC_ERR_PREAUTH_FAILED - pre-authentication information was invalid
condition: selectionFalse positive likelihood has not been assessed. Additional context may be needed during triage.
Tactics
Sub-techniques
Other