Windows DC - Possible replay attack.

Description

match="Failure Code: 0x22"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 18100 Group of windows rules. anchor level 0
   Matches no fields of its own.
2. 18105 Windows audit failure event. anchor level 4
   Matches no fields of its own.
3. 18139 Windows DC Logon Failure. anchor level 5
   Matches no fields of its own.
4. 18171 Windows DC - Possible replay attack. refinement level 10 this rule
   match="Failure Code: 0x22"

Rule dependencies

Depends on

• composes · Wazuh if_sid 18139
  • Windows DC Logon Failure.