[Snort-users] how would you log failed windows logins etc?

Horta, Benny BHorta1 at ...8080...
Fri May 16 11:10:21 EDT 2003


I am surprised no one has added to the default signatures failed login
attempts to a windows server how would such a signature be written and how
would someone log any administrator accout logins (ie user administrator)?

this would be useful to see account churners trying to bruteforce.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030516/a4c8bdd6/attachment.html>


More information about the Snort-users mailing list