01 / LOG ANALYSIS AND INDICATORS · LESSON 03

Find repeated failed logons

Group failed logons by host, account, and source address without merging unrelated activity.

12 min · learn at your pace

A count needs a definition

“Many failed logons” is not yet a detection rule. Specify which events count, how they are grouped, the observation window, and the threshold. This exercise treats the entire supplied export as its observation window and uses three failures as a practice threshold. It is not a recommended production alert threshold.

Filter to 4625 before grouping. A successful logon should not increase a failure count. Exclude the explicit missing-address marker - for this address-based rule, while remembering that those excluded records still exist.

Keep distinct activity distinct

Group on Computer, TargetUser, and SourceIp together. The same account can appear on several hosts, and different source addresses may need separate investigation. Grouping only by account merges those contexts and changes the question you are answering.

Import-Csv '/home/user/auth.csv' |
    Group-Object Computer, TargetUser, SourceIp |
    Select-Object Count, Name

A group has a Count and a Group collection containing the original rows. Take identity fields from a row in that collection. Do not split the displayed group name on punctuation; display strings are a poor data contract.

Emit structured findings with an inclusive threshold (-ge). A finding is a lead for review. Correlate it with account ownership, service behaviour, time, and successful logons before drawing a conclusion about intent.

Try an example.ps1

Import-Csv '/home/user/auth.csv' | Group-Object EventId | Select-Object Name, Count

YOUR TURN

Put it into practice.

Across all auth.csv records, find groups with at least 3 failed logons (EventId 4625). Exclude SourceIp “-”. Group by Computer, TargetUser, and SourceIp together. Emit Computer, TargetUser, SourceIp, and integer FailureCount for each qualifying group.

See an explained solution

One way to solve it.ps1

Import-Csv '/home/user/auth.csv' |
    Where-Object { $_.EventId -eq '4625' -and $_.SourceIp -ne '-' } |
    Group-Object Computer, TargetUser, SourceIp |
    Where-Object Count -GE 3 |
    ForEach-Object {
        $first = $_.Group[0]
        [pscustomobject]@{ Computer=$first.Computer; TargetUser=$first.TargetUser; SourceIp=$first.SourceIp; FailureCount=$_.Count }
    }

Filtering before grouping keeps successful logons out of the count. The three-field key separates WS-02 and the other source address from the four failures on WS-01.