Windows login signatures

[5creedus]

Which signature(s) would I use to track failed login attempts to the following O/S?

Windows, Unix and MAC

[sasa.rasovic]

I'm not sure how you plan to 'sense' login attempts since all are encrypted. (NTLM, Kerberos...)

You should rather think of using event loggin on the windows platform itself.

Sasa

[5creedus]

There are signautres for SMB failed logins but those cover attaching to a network share. There are signatures for failed FTP logins. If there are or there are not similar for Windows domain (not local logins) logins I'd like to know as well. Also for the other O/S I mentioned Unix and MAC. Using IDS I can set the severity to high so I get an alert when it fires.

[sasa.rasovic]

But ftp logins are in clear text. The similiar stands for smb null logins...those signatures are mostly not user adjustible.

I suppose you should check with CSA for that.