Re: [Snort-users] Windows Logon Failures

Brian Kimsey-Hickman wrote:
> We have a Window 2003 domain and we are see a lot of logon failures
> from apparently fictitious hosts.  Here is an example from the event
> viewer:
>
> Event Type:	Audit Failure
> Event Source:	Security
> Event Category:	Account Logon
> Event ID:	680
> Date:		1/24/2005
> Time:		10:26:33 AM
> User:		SYSTEM
> Computer:	DC1
> Description:
> Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>  Logon account:	root
>  Source Workstation:	\\RYDER
>  Error Code:	0xC0000064
>  
> In this case \\RYDER does not resolve through DNS or WINS so we don't
> know where these are coming from.
>
> We have snort up and running but what rules would we use that could
> give us an IP number on these hosts.
>
> Any help or advice would be appreciated.
>
> Thanks,
>
> Brian

  These two should provide some help:

sid:2923 || NETBIOS SMB repeated logon failure
sid:2924 || NETBIOS SMB-DS repeated logon failure


--
http://nk99.org/

... What I tell you three times is true.



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users