Skip to main content
Tier One
Medium

Repeated failed logons from a user's own workstation

A-1044

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
SIEM Correlation
Detection rule
SIEM-IDENT-BRUTE-002
Affected user
t.alvarez
Affected host
WKS-QA-11
Source IP
10.20.31.44
First seen
2026-07-24T13:41:00Z

Why this fired, in plain English

One account failed to sign in more than 10 times in five minutes.

Suggested playbook

Credential brute force & password spray

  1. 1. Identify the source IP. Internal (10.20.0.0/16) or external?
  2. 2. Check for a 4624 success from the same source after the failures.
  3. 3. Check status codes: 0xC000006A = bad password, 0xC0000072 = disabled account, 0xC0000234 = locked out.
  4. 4. Look for a 4723/4724 password change just before internal failures — cached credentials cause noise.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 4 events.

  1. Guided hint: this line matters

    ts=2026-07-24T13:36:12Z host=SRV-DC-01 EventID=4625 account="t.alvarez" src_ip=10.20.31.44 workstation="WKS-QA-11" logon_type=3 status=0xC000006A service="MSSQLSvc/reporting"

    The source is an internal 10.20.x.x address — the user's own desk machine.

  2. Guided hint: this line matters

    ts=2026-07-24T13:36:44Z host=SRV-DC-01 EventID=4625 account="t.alvarez" src_ip=10.20.31.44 logon_type=3 status=0xC000006A service="MSSQLSvc/reporting"

    Exactly the same service and error every ~30 seconds: that regularity means software retrying, not a human typing.

  3. Guided hint: this line matters

    ts=2026-07-24T13:30:02Z host=SRV-DC-01 EventID=4723 account="t.alvarez" caller="t.alvarez" result=success

    4723 = the user changed their own password six minutes before the failures started.

  4. ts=2026-07-24T13:41:00Z host=SRV-DC-01 EventID=4624 account="t.alvarez" src_ip=10.20.31.44 logon_type=2

    Logon type 2 = interactive at the keyboard. The user is signed in normally the whole time.

Related events

The order things happened in.

  1. 13:30Z

    User changed their own password

  2. 13:36Z

    Cached credential retries begin

  3. 13:41Z

    Threshold hit, alert raised

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.