I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be Brute Force attacks. However they come from a variety of accounts and computers, and are just simple auth attempts against the Domain Controller. I am confident they are not malicious.
What is the best way to track down a failed authentication event on a Domain Controller down to what application in the environment causes the authentication? They are similar to generic events found through Event Viewer on the Domain Controller, and I can see the hostname and username of where the auth came from.
Here is an example of the flood of logs I'm dealing with:
AV - Alert - "1566830804" --> RID: "18130"; RL: "5"; RG: "windows,win_authentication_failed,"; RC: "Logon Failure - Unknown user or bad password."; USER: "(no user)"; SRCIP: "192.168.1.59"; HOSTNAME: "(DomainCntrl) 192.168.1.2->WinEvtLog"; LOCATION: "(DomainCntrl) 192.168.1.2->WinEvtLog"; EVENT: "[INIT]2019 Aug 26 08:46:42 WinEvtLog: Security: AUDIT_FAILURE(4625): Microsoft-Windows-Security-Auditing: (no user): no domain: DomainCntrl.MyDomain.com: An account failed to log on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: MyUsername Account Domain: MyDomain Failure Information: Failure Reason: %%2313 Status: 0xc000006d Sub Status: 0xc0000064 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: Win10-Wrk Source Network Address: 192.168.1.59 Source Port: 57648 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted.[END]";