Skip to main content
Tier One
High

Password spray followed by successful sign-in

A-1043

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
SIEM Correlation
Detection rule
SIEM-IDENT-SPRAY-007
Affected user
m.okafor
Affected host
SRV-DC-01
Source IP
45.155.205.211
First seen
2026-07-24T13:26:00Z

Why this fired, in plain English

Many accounts got a small number of failed sign-ins from the same address, and then one of those accounts signed in successfully.

Suggested playbook

Credential brute force & password spray

  1. 1. Identify the source IP. Internal (10.20.0.0/16) or external?
  2. 2. Check for a 4624 success from the same source after the failures.
  3. 3. Check status codes: 0xC000006A = bad password, 0xC0000072 = disabled account, 0xC0000234 = locked out.
  4. 4. Look for a 4723/4724 password change just before internal failures — cached credentials cause noise.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 5 events.

  1. ts=2026-07-24T13:18:02Z host=SRV-DC-01 EventID=4625 account="a.brennan" src_ip=45.155.205.211 logon_type=3 status=0xC000006A failure_reason="bad password"

    4625 = failed logon. Logon type 3 means over the network, not at the keyboard.

  2. ts=2026-07-24T13:18:06Z host=SRV-DC-01 EventID=4625 account="p.osei" src_ip=45.155.205.211 logon_type=3 status=0xC000006A

  3. Guided hint: this line matters

    ts=2026-07-24T13:18:11Z host=SRV-DC-01 EventID=4625 account="m.okafor" src_ip=45.155.205.211 logon_type=3 status=0xC000006A

    One try each across 40 different accounts — that pattern is a password spray, not a brute force of one account.

  4. Guided hint: this line matters

    ts=2026-07-24T13:25:41Z host=SRV-DC-01 EventID=4624 account="m.okafor" src_ip=45.155.205.211 logon_type=3 auth_package="NTLM" mfa=none

    4624 = successful logon, from the exact same attacker IP, with no multi-factor challenge.

  5. Guided hint: this line matters

    ts=2026-07-24T13:25:58Z host=SRV-DC-01 EventID=4672 account="m.okafor" privileges="SeBackupPrivilege,SeSecurityPrivilege"

    4672 = special privileges assigned at logon. This account has more power than a normal user.

Related events

The order things happened in.

  1. 13:18Z

    40 accounts sprayed from one IP

  2. 13:25Z

    Successful NTLM logon as m.okafor

  3. 13:26Z

    Privileged logon recorded

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.