[Snort-sigs] windows authentication signatures

Albers, Lucas luke at ...2068...
Fri Dec 12 17:42:03 EST 2003

We have a snort box monitoring traffic to our windows domain controllers.
Is their as signature to detect authentication attempts?
I hope to detect when a single machine performs numerous authentication
attempts, and locks out all the accounts.
I have looked for signatures for this particular item, but have not found
any. Thanks.

--College of Engineering Security Administrator.
--Montana State University -Bozeman

More information about the Snort-sigs mailing list