SIEM Visualization Example 2: Failed Logon Attempts (Disabled Users)

In this example, we will create a SIEM visualization to monitor failed logon attempts against disabled users. This is particularly useful for detecting potential malicious activity, such as attackers attempting to use credentials of accounts that are no longer active. We'll walk through the process step-by-step, leveraging Kibana's visualization capabilities.

---

Step 1: Accessing the Dashboard

1. Spawn the Target System:

   • Navigate to the bottom of the section and click on "Click here to spawn the target system!".

2. Access Kibana:

   • Open your browser and navigate to http://[Target IP]:5601.

   • Click on the side navigation toggle and select "Dashboard".

3. Edit the Prebuilt Dashboard:

   • A prebuilt dashboard should be visible. Click on the "pencil"/edit icon to modify it.

4. Create a New Visualization:

   • Click on "Create visualization" to begin building the new visualization.

---

Step 2: Configuring the Visualization

Key Elements to Configure

1. Filter Data:

   • Use the filter option to narrow down the data to only include failed logon attempts against disabled users.

   • Add the following filters:

     • event.code: 4625 (Windows event ID for failed logon attempts).

     • winlog.event_data.SubStatus: 0xC0000072 (Indicates the failure is due to a disabled account).

2. Select the Index Pattern:

   • In the Index pattern field, specify windows* to focus on Windows-related logs.

3. Verify Fields:

   • Use the search bar to confirm the presence of fields like:

     • user.name.keyword (Username of the disabled account).

     • host.hostname.keyword (Machine where the logon attempt occurred).

     • winlog.event_data.SubStatus (SubStatus indicating the reason for the failure).

4. Choose Visualization Type:

   • From the dropdown menu, select "Table" as the visualization type.

---

Step 3: Building the Table Visualization

1. Configure Rows:

   • Click on "Rows" and configure the following:

     • Field: user.name.keyword

     • Rank by: Alphabetical (or Count of records, if available).

   • Close the Rows window.

2. Add Metrics:

   • Click on "Metrics" and select "Count" as the metric.

   • The table will populate with data showing the count of failed logon attempts per disabled user.

3. Add Host Information:

   • Add another Rows setting to include the machine where the failed logon occurred:

     • Field: host.hostname.keyword

   • The table will now display three columns:

     • Disabled User: Displays the usernames of disabled accounts.

     • Machine: Shows the hostname where the logon attempt occurred.

     • Failed Logon Attempts: Counts the number of failed attempts per user.

4. Save the Visualization:

   • Click on "Save and return" to add the visualization to the dashboard.

---

Step 4: Final Visualization

After completing the configuration, the final visualization will include:

1. Columns:

   • Disabled User: The username of the disabled account generating the failed logon attempt.

   • Machine: The hostname where the logon attempt occurred.

   • Failed Logon Attempts: The count of failed logon attempts for each disabled user.

2. Filters:

   • Only events with event.code: 4625 (failed logon attempts) and winlog.event_data.SubStatus: 0xC0000072 (disabled account) are included.

3. Sorting:

   • Sort the table by the count of failed logon attempts in descending order to prioritize users with the most failed attempts.

---

Step 5: Review and Save

1. Review the Dashboard:

   • Navigate back to the Dashboard page to view the new visualization.

   • Ensure that the table displays accurate and actionable insights.

2. Save the Dashboard:

   • Click on the "Save" button to save your progress.

---

Key Takeaways

1. Focus on Disabled Accounts:

   • Monitoring failed logon attempts against disabled accounts helps identify potential misuse of credentials or brute-force attacks targeting inactive accounts.

2. Leverage SubStatus Codes:

   • The winlog.event_data.SubStatus field provides critical context about the reason for a failed logon attempt. For disabled accounts, the value 0xC0000072 explicitly indicates that the account is disabled.

3. Visualization Enhances Clarity:

   • Using a table visualization allows SOC analysts to quickly identify patterns, such as repeated failed attempts from specific users or machines.

4. Best Practices:

   • Use .keyword fields for aggregations to ensure accurate results.

   • Regularly refine filters to exclude irrelevant data and reduce noise.

   • Combine visualizations into dashboards for a comprehensive view of security events.

---

Example Use Case

• Scenario: An attacker uses stolen credentials to attempt logins across multiple systems. If the credentials belong to a disabled account, these attempts will generate events with event.code: 4625 and winlog.event_data.SubStatus: 0xC0000072.

• Action: The SOC team can use this visualization to:

  • Identify the source of the attack (e.g., specific machines or IP addresses).

  • Block malicious IPs or investigate compromised systems.

  • Strengthen security policies to prevent the reuse of disabled account credentials.

By following these steps, you can create a robust visualization for monitoring failed logon attempts against disabled users, enabling your SOC team to proactively detect and respond to potential threats.