Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000108

AD domain with multiple failed authentication attempts by non-existing users using Kerberos

High
Active Directory
Initial Access
v27

Signature Identity

CTD-000108
Threat ID
27
Version
IOA-IOC
Indicator Type

Threat Description

Failed logon attempts with multiple disabled domain users might be an indication of a threat actor trying to perform a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. The detection mechanism uses the event 4768 with the failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.

MITRE ATT&CK: Attack Tactics

Initial Access

D3FEND: Defend Tactics

Local Account Monitoring

Remediation

  1. To reset the password of a user affected by Password Spray attack using ADUC (Active Directory Users and Computers):
    1. Run the ADUC console (dsa.msc).
    2. Search for the user account in the AD domain.
    3. Right-click on it.
    4. Select Reset password.
    5. You can search by right-clicking the domain and selecting Find, or by navigating to the user’s location in AD.
    6. In the Reset Password dialog, enter the new password and confirm it. You can also check the option to force the user to change the password at the next logon.
    7. Click OK.
  2. To eliminate easily guessed passwords, configure Microsoft Entra Password Protection. This capability includes a globally banned password list that Microsoft maintains and updates. You can also block a custom list of passwords that are relevant to your region or company. Once enabled, users won’t be able to choose a password on either of these lists, making it significantly less likely that an adversary can guess a user’s password. You can also use this feature to define how many sign-in attempts will trigger a lockout and how long the lockout will last. Learn more: Deploy on-premises Microsoft Entra Password Protection – Microsoft Entra ID | Microsoft Learn.
  3. The best way to reduce your risk of password spray is to eliminate passwords entirely. Solutions like Windows Hello or FIDO2 security keys let users sign in using biometrics and/or a physical key or device. Get started by enabling Mult-Factor Authentication (MFA) across all your accounts. MFA requires that users sign in with at least two authentication factors: something they know (like a password or PIN), something they are (such as biometrics), and/or something they have (such as a trusted device).

Frequently Asked Questions

What does AD domain with multiple failed authentication attempts by non-existing users using Kerberos mean?

This indicates repeated failed login attempts via Kerberos, where the attempted usernames do not exist in the domain. The mechanism behind this is that an attacker is attempting to guess or crack passwords through a password spraying attack.

This is rated high severity because it indicates a potential password spraying attack, which can lead to successful login attempts and privilege escalation. The repeated failed attempts suggest an attacker is actively trying to gain access or elevate privileges in the Active Directory environment.

Attackers may use repeated failed login attempts via Kerberos to gather information about valid usernames and potentially crack passwords or gain access to the Active Directory environment through a password spraying attack. This can support later attacker activity, such as lateral movement and privilege escalation.

Cayosoft Guardian detects this by monitoring event 4768 in the Active Directory security logs, which indicates a client not found in the Kerberos database. This detection mechanism helps identify potential password spraying attacks and alerts administrators to take action.

Cayosoft Guardian reduces this risk by alerting administrators to disable or reset affected user accounts, limiting potential damage from password spraying attacks and maintaining security exposure in the Active Directory environment. This helps provide visibility into attacker activity and supports investigation and response efforts.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Password Spraying
Attack Tactics
Initial Access
Defend Tactics
Local Account Monitoring
Indicator Types
IOA IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical