Windows Security: Kerberos 4771 Pre-Authentication Failures for Machine Account Password Guessing
Triggers on Kerberos pre-authentication failures (4771) for machine accounts using status codes 0x19/0x18.
- Product
- windows
- Service
- security
- Author
- Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-10-19
- Updated
- 2026-10-21
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security Event ID 4771 where the target account name ends with '$' (machine accounts) and Kerberos pre-authentication fails with status codes 0x19 or 0x18. Repeated failures of this type can indicate an attacker is trying password guesses against service or machine accounts rather than normal interactive logons. The detection relies on 4771 audit telemetry including TargetUserName and Status values to identify machine-account pre-authentication failure conditions.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
- ipurple.teamhttps://ipurple.team/2025/09/02/golden-dmsa/
- semperis.comhttps://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_susp_failed_logon_for_service_account.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Kerberos 4771 Pre-Authentication Failures for Machine Account Password Guessing"
id: 2c6d9741-23b2-49d3-a40f-a71647752de9
status: experimental
description: This rule flags Windows Security Event ID 4771 where the target account name ends with '$' (machine accounts) and Kerberos pre-authentication fails with status codes 0x19 or 0x18. Repeated failures of this type can indicate an attacker is trying password guesses against service or machine accounts rather than normal interactive logons. The detection relies on 4771 audit telemetry including TargetUserName and Status values to identify machine-account pre-authentication failure conditions.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
- https://ipurple.team/2025/09/02/golden-dmsa/
- https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_susp_failed_logon_for_service_account.yml
author: Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-10-19
tags:
- attack.credential-access
- attack.t1110.001
- detection.threat-hunting
logsource:
product: windows
service: security
detection:
selection:
EventID: 4771
TargetUserName|endswith: $
Status:
- "0x19"
- "0x18"
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: f932f9f9-a6bd-45e3-9a0d-ca613fe7fc40
type: derived