Insecure Or Cleartext Authentication Detected Rule
This rule detects a high number of failed authentication attempts followed by a successful authentication from the same source IP address and user. It specifically looks for events categorized as 'Insecure_Authentication' within the 'Authentication' datamodel. The rule aggregates authentication events by source IP, user, destination, application, caller user name, target user name, logon type, event code, signature, tag, action, authentication method, authentication service, vendor product, and user priority. It then filters for scenarios where there are more than 5 failures and more than 1 success for the same aggregated criteria.
Splunk (SPL)
