SMB/NTLM
Failed network logons (event 4625, logon type 3) are evaluated with IP, user, domain and failure type.
SMB & Kerberos
Protect SMB and Kerberos against brute force and password spraying
Attacks on file shares and domain accounts are quiet: few attempts per account, spread across many accounts. ServerBouncer detects exactly this pattern and blocks the source.
Kerberos
Failed pre-authentication (event 4771) on domain controllers – wrong password, unknown or locked user.
Detect password spraying
A dedicated counter per IP for the number of distinct user names detects spraying; a subnet counter catches distributed attacks.
Good to know
- A successful logon only resets the counter of that IP and user combination, not the spraying or subnet counters.
- A stale password of a known, otherwise successful combination does not cause a block but a warning.
- The hardening check looks at SMBv1 and can disable it with one click.
- It also checks whether logon auditing is active – without it there are no events.
- SMB can additionally be made a protected service that opens only for grants.
More use cases
Try ServerBouncer on your servers
Starts in learning mode – you first see what would be blocked.