Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000110

AD domain with multiple failed authentication attempts via Kerberos

High
Active Directory
Initial Access
v12

Signature Identity

CTD-000110
Threat ID
12
Version
IOA-IOC
Indicator Type

Threat Description

If one source endpoint tries to authenticate with different unique user accounts using the Kerberos protocol, it might be a threat actor performing a Password Spraying attack against an Active Directory environment. The detection mechanism uses native events from Security Log. The event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT) and failure code 0x18 means `wrong password provided` while the attempted user is a legitimate domain user.

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.

MITRE ATT&CK: Attack Tactics

Initial Access

D3FEND: Defend Tactics

Local Account Monitoring

Remediation

  1. To reset the password of a user affected by Password Spray attack using ADUC (Active Directory Users and Computers):
    1. Run the ADUC console (dsa.msc).
    2. Search for the user account in the AD domain.
    3. Right-click on it.
    4. Select Reset password.
    5. You can search by right-clicking the domain and selecting Find, or by navigating to the user’s location in AD.
    6. In the Reset Password dialog, enter the new password and confirm it. You can also check the option to force the user to change the password at the next logon.
    7. Click OK.
  2. To eliminate easily guessed passwords, configure Microsoft Entra Password Protection. This capability includes a globally banned password list that Microsoft maintains and updates. You can also block a custom list of passwords that are relevant to your region or company. Once enabled, users won’t be able to choose a password on either of these lists, making it significantly less likely that an adversary can guess a user’s password. You can also use this feature to define how many sign-in attempts will trigger a lockout and how long the lockout will last. Learn more: Deploy on-premises Microsoft Entra Password Protection – Microsoft Entra ID | Microsoft Learn.
  3. The best way to reduce your risk of password spray is to eliminate passwords entirely. Solutions like Windows Hello or FIDO2 security keys let users sign in using biometrics and/or a physical key or device. Get started by enabling Mult-Factor Authentication (MFA) across all your accounts. MFA requires that users sign in with at least two authentication factors: something they know (like a password or PIN), something they are (such as biometrics), and/or something they have (such as a trusted device).

Frequently Asked Questions

What does AD domain with multiple failed authentication attempts via Kerberos mean?

An Active Directory (AD) domain experiences multiple failed authentication attempts using the Kerberos protocol, indicating a potential password guessing attack. This occurs when an attacker attempts to authenticate with different user accounts using the same password.

This condition is rated high severity because it allows attackers to gather information about user account passwords, enabling them to plan and execute a targeted attack. The attacker can use this information to attempt password guessing for legitimate user accounts in the domain.

Attackers can use the information about multiple failed authentication attempts to plan and execute a targeted password guessing attack, attempting to guess passwords for legitimate user accounts in the domain. This is done by trying different combinations of usernames and passwords.

Cayosoft Guardian detects this condition by monitoring native events from Security Log, specifically looking for event 4771 generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT) and failure code 0x18 indicating `wrong password provided`.

Cayosoft Guardian helps reduce the risk by providing visibility into potential password guessing attacks, alerting administrators to take action, such as resetting passwords for affected users and configuring Microsoft Entra Password Protection to eliminate easily guessed passwords. It also supports ongoing monitoring to quickly catch any re-occurrence of this issue.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Password Spraying
Attack Tactics
Initial Access
Defend Tactics
Local Account Monitoring
Indicator Types
IOA IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical