Potential Kerberos Pre-Authentication Failure for Machine Accounts

title: Potential Kerberos Pre-Authentication Failure for Machine Accounts
id: f932f9f9-a6bd-45e3-9a0d-ca613fe7fc40
status: experimental
description: |
    Detects Kerberos pre-authentication failures for machine accounts, which may indicate attempts to brute-force service account passwords.
    This rule helps identify potential Golden dMSA attacks where attackers try multiple password combinations.
    When hunting, look for multiple 4771 failures for machine accounts in short succession with status code 0x18 (KDC_ERR_PREAUTH_FAILED). Distinguish these from 0x19 (KDC_ERR_PREAUTH_REQUIRED), which indicates that additional pre-authentication is required rather than that a password was incorrect.
    Hypothesis: An attacker is attempting to identify machine accounts with weak passwords for attacks like Golden dMSA by performing Kerberos pre-authentication brute-force against machine accounts (ending with $). Multiple failures in a short time window from the same source IP or targeting multiple machine accounts suggests credential guessing activity.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
    - https://ipurple.team/2025/09/02/golden-dmsa/
    - https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
author: Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-19
tags:
    - attack.credential-access
    - attack.t1110.001
    - detection.threat-hunting
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4771
        TargetUserName|endswith: '$'
        Status:
            - '0x19' # KDC_ERR_PREAUTH_REQUIRED - additional pre-authentication is required
            - '0x18' # KDC_ERR_PREAUTH_FAILED - pre-authentication information was invalid
    condition: selection
falsepositives:
    - Unknown
level: medium