612 failed logins in an hour: reading Event ID 4625 to tell an attack from… an old laptop
TL;DR
Event ID 4625 is Windows’ “failed logon” event. A flood of 4625s from one source may be brute force — or just a machine, service or scheduled task still using an old password. Reading the right fields avoids false alarms.
A familiar scenario
Midnight: one account fails to log in hundreds of times. The source IP turns out to be an old office machine — the owner changed their password, and the old machine keeps signing in with the old one. Much of SOC work is telling cases like this apart from real attacks.
Fields to read
| Field | Meaning |
|---|---|
| Account Name | The targeted account — prioritise admins and domain admins |
| Source Network Address | Source IP — internal or from the internet? |
| Logon Type | How the logon was attempted: network, interactive, RDP, service… |
| Status / Sub Status | Why it failed: bad password, unknown user, locked out, clock skew with the DC… |
| Workstation / Process | Which machine and process made the request — a service or a person? |
Brute force or misconfiguration?
| Attack indicators | Misconfiguration / stale password indicators |
|---|---|
| Many different accounts from one IP (password spraying) | Always the same account, from one fixed machine |
| Unfamiliar, internet-facing IP | Internal, known machine |
| Non-existent usernames | Regular rhythm matching a service or scheduled task |
| Followed by 4624 (successful logon) from the same source | Recent password change or expired service-account password |
Suggested triage
- Identify the failure reason (Status/Sub Status) and targeted accounts.
- Prioritise privileged accounts; determine whether the source IP is internal or external.
- Look for other alerts involving the same user/host in the past 48 hours.
- Check whether the credentials are used by services or scheduled tasks; ask the account owner.
- Search for successful 4624 events from that source — a sign of possible compromise.
- If malicious: isolate the host, reset credentials, run a malware scan, and close the initial access vector.
Further reading: Elastic – Multiple Logon Failure from the same Source Address