This eval for password can be easily used for any field where a user can accidentally type in a password or even worse both username/password during login which generates a failed event. Below example is for Windows failed login. The eval will match 10 or more characters with 1 uppercase, 1 lower case, 1 […]
Password Non Compliance Windows
The following splunk queries will return results for failed attempts to change passwords. This is likely a result of users not meeting password requirements. Be sure to have the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows 2003 and Older:
|
1 |
sourcetype="WinEventLog:Security" EventCode=627 Type="Failure Audit"| eval Date=strftime(_time, "%Y/%m/%d") | stats count by Date, Target_Account_Name, host | sort - Date |
Windows 2008 and Newer:
|
1 |
sourcetype="WinEventLog:Security" EventCode=4723 Keywords="Audit Failure" | eval Date=strftime(_time, "%Y/%m/%d") | rex "Target\sAccount:\s+Security\sID:.*\\\(?<account>\S+)" | stats count by Date, account, host | sort - Date |
Password changes in a Windows environment by user account
Password changes in a Windows environment by user account.
|
1 |
sourcetype="WinEventLog:Security" (EventCode=628 OR EventCode=627 OR EventCode=4723 OR EventCode=4724) | chart count by user |
