RE: Windows Logon Failures

["Bristol, Gary L." <gbristol () ou edu>]

In the event logs you might also find another event associated with this
same logon failure which lists the sourece ip.
Event ID: 529

EVENT #
 270658
 
EVENT LOG
 Security
 
EVENT TYPE
 Audit Failure
 
SOURCE
 Security
 
CATEGORY
 Logon/Logoff
 
EVENT ID
 529
 
USERNAME
 NT AUTHORITY\SYSTEM
  

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of
kimhick () cfl rr com
Sent: Tuesday, January 25, 2005 10:14 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Windows Logon Failures

We have a Window 2003 domain and we are see a lot of logon failures
from apparently fictitious hosts.  Here is an example from the event
viewer:

Event Type:     Audit Failure
Event Source:   Security
Event Category: Account Logon
Event ID:       680
Date:           1/24/2005
Time:           10:26:33 AM
User:           SYSTEM
Computer:       DC1
Description:
Logon attempt by:       MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: root
Source Workstation:    \\RYDER
Error Code:    0xC0000064

In this case \\RYDER does not resolve through DNS or WINS so we don't
know where these are coming from.

We have snort up and running but what rules would we use that could
give us an IP number on these hosts.

Any help or advice would be appreciated.

Thanks,

Brian

        



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users