Multiple Failed Kerberos Pre-Authentication Attempts

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects multiple failed Kerberos pre-authentication attempts (EventID 4771 with status codes 0x18 or 0x1f) from a single IP address against a target user within a short timeframe (20 attempts in 5 minutes). This pattern is indicative of a brute-force attack against Kerberos accounts.