Bogus failed login attempts report?

Feature Question

My CS instance shows a number of failed login attempts on a multitude of hosts (some login attempts in the range of 1k per minute), however they all have the same login error: Domain User Already Logged In

Reviewing the Investigate details for a host's login history does not reflect this activity and appears normal. Does anyone else see similar activity in their CS instance?

Posted Aug 26, 2020, 1:01 PM UTC · edited

Sort by:

Andrew-CSCS ENGINEER•6 yr. ago

Hi there. Can you send a link to the report you're looking at in Falcon? I'll have a peek.

gregoldeOP•6 yr. ago

Thanks! I'm just looking at the Failed Logon Attempts report in the Discover module:

https://falcon.crowdstrike.com/discover/discover/en-US/app/eam2/discover__failedlogons?form.user_tok=*&form.account_tok=*&form.failedcount=3&form.period_tok=604801&form.customer_tok=*

There are thousands of failed login attempts listed, but they all show "Domain user already logged on" under the lastest logon info. Let me know if you need more information (or if this isn't the link to the report you were asking for).

Andrew-CSCS ENGINEER•6 yr. ago

Thanks! Looks like a bug that the team is going to look at this afternoon. The TL;DR on the nature of the bug is that the report is looking at the event UserLogonFailed and not UserLogonFailed2... which is new and has all sorts of goodies within.

Thanks for reporting this!