Security

Insecure Or Cleartext Authentication Detected Rule

maalyu1612
New Member

Hi Team,

Rule "Insecure Or Cleartext Authentication Detected" detects says when Logon type "8" is detected in windows logs. 

As per Splunk :
Detects authentication requests that transmit the password over the network as cleartext (unencrypted)

https://docs.splunksecurityessentials.com/content-detail/insecure_or_cleartext_authentication_detect...

As Per Windows
The credentials do not traverse the network in plaintext (also called cleartext).

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

Could you please let us know why this difference in description, This is creating some challenges in understanding the logs.

Can someone help on this.

Labels (1)
0 Karma

Stefanie
Builder

Logon Type 8 is generated when something was logged onto through the network using a cleartext password. 

 

That last sentence from the Microsoft Documentation  is a little confusing for me too. I had to read it a few times to understand what it was referencing.

During Network Logins, the Server that is being logged into has previously cashed those credentials. 

During authentication, hashes are created and sent to the Server are used to compare to what the computer has cached. 

This was done without utilizing SSL/TLS.

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...