The SPN (Service Principal Name) check for a client connection failed. May indicate relay attack or Kerberos misconfiguration.
NTLM relay attacks can generate SPN check failures. Tools: Responder, ntlmrelayx may generate this when relaying credentials. Multiple failures may indicate active relay attack in progress.
Alert: frequent SPN check failures from single source IP. Correlate with network events for relay attack indicators.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Credential Access | LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5168 // SPN check for SMB/SMB2 failed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=5168
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# SPN check for SMB/SMB2 failed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
SPN check for SMB/SMB2 failed. The SPN (Service Principal Name) check for a client connection failed. May indicate relay attack or Kerberos misconfiguration.
Event 5168 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).
Event 5168 is associated with: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001).
Alert: frequent SPN check failures from single source IP. Correlate with network events for relay attack indicators.