detection.wiki

Microsoft-Windows-Security-Auditing › Event 4625

Event ID 4625 — An account failed to log on.

Provider
Microsoft-Windows-Security-Auditing
Channel
Security
Audit Policy
Logon/Logoff → Logon
Collection Priority
Recommended (Palantir, others)
Opcode
Info

Description

An account failed to log on.

Message #

An account failed to log on.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Logon Type: %11

Account For Which Logon Failed:
	Security ID: %5
	Account Name: %6
	Account Domain: %7

Failure Information:
	Failure Reason: %9
	Status: %8
	Sub Status: %10

Process Information:
	Caller Process ID: %18
	Caller Process Name: %19

Network Information:
	Workstation Name: %14
	Source Network Address: %20
	Source Port: %21

Detailed Authentication Information:
	Logon Process: %12
	Authentication Package: %13
	Transited Services: %15
	Package Name (NTLM only): %16
	Key Length: %17

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Fields #

NameDescription
Security_ID[Subject] Security ID. Indicates the account on the local system which requested the logon.
Account_Name[Subject] Account Name. Indicates the account on the local system which requested the logon.
Account_Domain[Subject] Account Domain. Indicates the account on the local system which requested the logon.
Logon_ID[Subject] Logon ID. Indicates the account on the local system which requested the logon.
Security_ID[Account For Which Logon Failed] Security ID.
Account_Name[Account For Which Logon Failed] Account Name.
Account_Domain[Account For Which Logon Failed] Account Domain.
Status HexInt32[Failure Information] Status. NTSTATUS reference
Failure_Reason[Failure Information] Failure Reason.
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
Sub_Status[Failure Information] Sub Status. NTSTATUS reference
Logon_Type[Subject] Logon Type. Indicates the account on the local system which requested the logon. Logon type reference
Logon_Process[Detailed Authentication Information] Logon Process. Provides detailed information about this specific logon request.
Authentication_Package[Detailed Authentication Information] Authentication Package. Provides detailed information about this specific logon request.
Workstation_Name[Network Information] Workstation Name. Indicates where a remote logon request originated.
Transited_Services[Detailed Authentication Information] Transited Services. Indicate which intermediate services have participated in this logon request.
Package_Name_NTLM_only[Detailed Authentication Information] Package Name (NTLM only). Indicates which sub-protocol was used among the NTLM protocols.
Key_Length[Detailed Authentication Information] Key Length. Indicates the length of the generated session key. This will be 0 if no session key was requested.
Caller_Process_ID[Process Information] Caller Process ID. Indicates which account and process on the system requested the logon.
Caller_Process_Name[Process Information] Caller Process Name. Indicates which account and process on the system requested the logon.
Source_Network_Address[Network Information] Source Network Address. Indicates where a remote logon request originated.
Source_Port[Network Information] Source Port. Indicates where a remote logon request originated.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4625,
    "version": 0,
    "level": 0,
    "task": 12544,
    "opcode": 0,
    "keywords": 9227875636482146304,
    "time_created": "2016-09-19T16:50:06.477878Z",
    "event_record_id": 2455,
    "correlation": {
      "#attributes": {
        "ActivityID": "B864D168-0B7B-0000-89D1-64B87B0BD201"
      }
    },
    "execution": {
      "process_id": 752,
      "thread_id": 4068
    },
    "channel": "Security",
    "computer": "DESKTOP-M5SN04R",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-0-0",
    "SubjectUserName": "-",
    "SubjectDomainName": "-",
    "SubjectLogonId": "0x0",
    "TargetUserSid": "S-1-0-0",
    "TargetUserName": "JcDfcZTc",
    "TargetDomainName": ".",
    "Status": "0xc000006d",
    "FailureReason": "%%2313",
    "SubStatus": "0xc0000064",
    "LogonType": 3,
    "LogonProcessName": "NtLmSsp ",
    "AuthenticationPackageName": "NTLM",
    "WorkstationName": "6hgtmVlrrFuWtO65",
    "TransmittedServices": "-",
    "LmPackageName": "-",
    "KeyLength": 0,
    "ProcessId": "0x0",
    "ProcessName": "-",
    "IpAddress": "192.168.198.149",
    "IpPort": "50249"
  }
}

Detection Patterns #

Community Notes #

The Status field indicates the top-level failure reason; SubStatus provides additional detail. When Status is 0xC000006D (generic logon failure), check SubStatus for the specific cause.

Kerberos result codes (Status, when authentication uses Kerberos):

CodeDescription
0x6KDC_ERR_C_PRINCIPAL_UNKNOWN — invalid/non-existent user account
0x7KDC_ERR_S_PRINCIPAL_UNKNOWN — requested server not found
0xCKDC_ERR_POLICY — policy restriction prohibited logon
0x12KDC_ERR_CLIENT_REVOKED — account locked, disabled, or expired
0x17KDC_ERR_KEY_EXPIRED — expired password
0x18KDC_ERR_PREAUTH_FAILED — invalid password
0x25KRB_AP_ERR_SKEW — clock skew too great between client and server

NTSTATUS codes (Status and SubStatus):

CodeNameDescription
0xC000006DSTATUS_LOGON_FAILUREGeneric logon failure — check SubStatus for detail
0xC0000064STATUS_NO_SUCH_USERNon-existent account username
0xC000006ASTATUS_WRONG_PASSWORDIncorrect password (username correct)
0xC000006ESTATUS_ACCOUNT_RESTRICTIONAccount restriction prevented logon
0xC000006CSTATUS_PASSWORD_RESTRICTIONPassword does not meet policy requirements
0xC000006FSTATUS_INVALID_LOGON_HOURSAccount not allowed to log on at this time
0xC0000070STATUS_INVALID_WORKSTATIONAccount not allowed to log on from this computer
0xC0000071STATUS_PASSWORD_EXPIREDExpired password
0xC0000072STATUS_ACCOUNT_DISABLEDDisabled account
0xC000005ESTATUS_NO_LOGON_SERVERSNo logon servers available
0xC0000133STATUS_TIME_DIFFERENCE_AT_DCClock skew between client and DC too great
0xC000015BSTATUS_LOGON_TYPE_NOT_GRANTEDLogon type not granted to this account
0xC000018DSTATUS_TRUSTED_RELATIONSHIP_FAILURETrust relationship between domain and trusted domain failed
0xC0000192STATUS_NETLOGON_NOT_STARTEDNetlogon service not started
0xC0000193STATUS_ACCOUNT_EXPIREDExpired account
0xC0000224STATUS_PASSWORD_MUST_CHANGEPassword must change at next logon
0xC0000234STATUS_ACCOUNT_LOCKED_OUTAccount locked out
0xC0000388STATUS_DOWNGRADE_DETECTEDKerberos/NTLM downgrade detected
0xC0000413STATUS_AUTHENTICATION_FIREWALL_FAILEDBlocked by authentication policy/silo

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

  • Failed Logon From Public IP source medium: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Elastic # view in reference

  • Privileged Accounts Brute Force source medium: Identifies multiple consecutive logon failures targeting more than one Admin account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts.
  • Multiple Logon Failure from the same Source Address source medium: Identifies multiple consecutive logon failures from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts.

Splunk # view in reference

  • Detect Password Spray Attempts source: This analytic employs the 3-sigma approach to detect an unusual volume of failed authentication attempts from a single source. A password spray attack is a type of brute force attack where an attacker tries a few common passwords across many different accounts to avoid detection and account lockouts. By utilizing the Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing comprehensive coverage and enhancing security against these attacks.
  • Windows Multiple Users Failed To Authenticate From Process source: The following analytic detects a source process failing to authenticate with 30 unique users, indicating a potential Password Spraying attack. It leverages Windows Event 4625 with Logon Type 2, collected from domain controllers, member servers, and workstations. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or further compromise of the network, posing a severe security risk.
  • Windows Multiple Users Remotely Failed To Authenticate From Host source: The following analytic identifies a source host failing to authenticate against a remote host with 30 unique users. It leverages Windows Event 4625 with Logon Type 3, indicating remote authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information. This detection is crucial for real-time security monitoring and threat hunting.
Show 2 more (5 total)
  • Windows Unusual Count Of Users Failed To Authenticate From Process source: The following analytic identifies a source process failing to authenticate multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625, which logs failed logon attempts, and uses statistical analysis to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
  • Windows Unusual Count Of Users Remotely Failed To Auth From Host source: The following analytic identifies a source host failing to authenticate against a remote host with multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625 (failed logon attempts) and Logon Type 3 (remote authentication) to detect this behavior. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the network.

Kusto Query Language # view in reference

References #