Snort mailing list archives
Windows Logon Failures
From: Brian Kimsey-Hickman <kimhick () gmail com>
Date: Tue, 25 Jan 2005 09:01:47 -0500
We have a Window 2003 domain and we are see a lot of logon failures from apparently fictitious hosts. Here is an example from the event viewer: Event Type: Audit Failure Event Source: Security Event Category: Account Logon Event ID: 680 Date: 1/24/2005 Time: 10:26:33 AM User: SYSTEM Computer: DC1 Description: Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: root Source Workstation: \\RYDER Error Code: 0xC0000064 In this case \\RYDER does not resolve through DNS or WINS so we don't know where these are coming from. We have snort up and running but what rules would we use that could give us an IP number on these hosts. Any help or advice would be appreciated. Thanks, Brian ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Windows Logon Failures kimhick (Jan 25)
- <Possible follow-ups>
- RE: Windows Logon Failures Bristol, Gary L. (Jan 25)
- Windows Logon Failures Brian Kimsey-Hickman (Jan 26)
- Re: Windows Logon Failures Nerijus Krukauskas (Jan 26)
- Re: Windows Logon Failures kimhick (Jan 26)