Aleksandar Tishev
@Tishev0 followers0 downloads31 copies0 likes353 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
1
1
1
Detects a high volume of Kerberos pre-authentication failures (Event ID 4771, Status 0x18) against multiple distinct user accounts originating from a single source IP address within a short time window. This behavior is characteristic of password spraying attacks where an attacker attempts a small number of common passwords across many accounts to avoid lockouts and detection in a Windows Active Directory environment.
