一般 #1222
已結束Asia Cyber Security Service Portal (ACSSP) 【Reply in Jira】[INCGC-15458]-Low-Windows Bruteforce Attempt Detected
100%
概述
Analysis: The alert indicates a brute-force style authentication attempt targeting user A40008 from workstation YILANA40008 via the domain controller YILAND-SRV.YILAND1.COM.TW, which was blocked by the security system. Since the action is BLOCK and the description shows a Status OK, there were no successful logins.
Recommendations:
1. Investigate the time-of-day restrictions configured for the user to confirm if the login attempt was legitimate and aligned with the user's allowed login times
2. Review the account activity of user to check for any successful logins or suspicious behavior.
3. Implement account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed
4. Review account policies to confirm and reinforce time-of-day restrictions.
檔案