[Prelude Hybrid IDS] #215: ntsyslog.rules does not detect domain login events
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#215: ntsyslog.rules does not detect domain login events
-------------------------+--------------------------------------------------
Reporter: gegomez | Owner: grgomez
Type: defect | Status: new
Priority: normal | Milestone: Prelude-LML 0.9.9
Component: prelude-lml | Version: 0.9
Severity: normal | Keywords:
-------------------------+--------------------------------------------------
The ruleset appears to detect only host-based login attempts rather than
login attempts against a domain.
event id 675: (bad password)
security[failure] 675 NT AUTHORITY\SYSTEM Pre-authentication failed: User
Name:mike User ID: %{x-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxx} Service
Name:krbtgt/HQ Pre-Authentication Type:0x2 Failure Code:0x18 Client
Address:10.120.120.152
more info: http://www.ultimatewindowssecurity.com/events/com298.html
--
Ticket URL: <https://trac.prelude-ids.org/ticket/215>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel