Sigma rule: Potential Kerberos Pre-Authentication Failure for Machine Accounts

Rule

Title

Potential Kerberos Pre-Authentication Failure for Machine Accounts

Status

experimental

Level

medium

Author

Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-10-19

File

rules-threat-hunting/windows/builtin/security/win_security_susp_failed_logon_for_service_account.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Kerberos pre-authentication failures for machine accounts, which may indicate attempts to brute-force service account passwords.
This rule helps identify potential Golden dMSA attacks where attackers try multiple password combinations.
When hunting, look for multiple 4771 failures for machine accounts in short succession with status code 0x18 (KDC_ERR_PREAUTH_FAILED). Distinguish these from 0x19 (KDC_ERR_PREAUTH_REQUIRED), which indicates that additional pre-authentication is required rather than that a password was incorrect.
Hypothesis: An attacker is attempting to identify machine accounts with weak passwords for attacks like Golden dMSA by performing Kerberos pre-authentication brute-force against machine accounts (ending with $). Multiple failures in a short time window from the same source IP or targeting multiple machine accounts suggests credential guessing activity.

Log source

product

windows

service

security

Detection

selection:
    EventID: 4771
    TargetUserName|endswith: '$'
    Status:
        - '0x19' # KDC_ERR_PREAUTH_REQUIRED - additional pre-authentication is required
        - '0x18' # KDC_ERR_PREAUTH_FAILED - pre-authentication information was invalid
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1110.001
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1110.001

References

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
• https://ipurple.team/2025/09/02/golden-dmsa/
• https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/builtin/security/win_security_susp_failed_logon_for_service_account.yml