User Name Does Not Exist Expand / Collapse
Author
Message
Posted 11/19/2009 4:42:43 PM
Forum Member

Forum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum Member

Group: Forum Members
Last Login: 2/24/2012 7:49:27 PM
Posts: 26, Visits: 12
Randy,

I am seeing some odd behavior in regards to EVID 680. The events are random and always create a 680 EVID - User Name Does Not Exist, with a user name that starts with '@@b' followed by junk characters. Some examples are - @@bbhgiqggavhg#vpjkebpa5hnwsja, @@bphmrqm#4yhhhbkeleeegbzddmvb, and @@bfsc0a3sxxw4bcc1ax#wenvp0rum.

These only hit two of our 12 DCs. I'd like to try and do a packet capture, but the times are so random I'm not sure if I would be able to grab any relevant information.

Any ideas?

Thanks
Post #276
Posted 3/10/2010 5:33:03 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
looks like some kind of bruteforce user name guessing attempt or a very broken program?
Post #327
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 6:02pm