Potential Password Spraying

Follow the evidence. Build your hypothesis. Make the call.

● Investigation active

Follow the thread.

Each discovery leaves a trace.

Start with what you know

INITIAL ALERT

FILE-SRV02

Potential Password Spraying

EventType: Potential Password Spraying — Multiple Account Failures
AlertUtc: 2026-09-16 10:14:00
SourceAddress: 10.20.4.18
TargetComputer: FILE-SRV02
FailureCount: 34
DistinctAccounts: 28
SuccessCount: 2
Window: 10:02–10:14 UTC
FailureEventId: 4625
SuccessEventId: 4624
LogonType: 3
AuthenticationPackage: NTLM
FailureSubStatus: 0xC000006A
Detection: high distinct-user count from one source; low failures per account

WHERE TO LOOK

SIEM correlation · Windows Security 4625/4624

NEXT STEP

What do you investigate next?