// REFERENCE
4625 — Failed logon
Log: Security
Medium risk
A logon attempt failed. The Status/Sub Status explains why (no such user, bad password, disabled account…). It is the go-to event for detecting brute force and password spraying.
Hunt for: many 4625s with a single password across many accounts (spraying), or bursts against one account from an external IP.
Related tools
Work with this in:
Related
4624
4624 — Successful logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4800
4800 — Workstation locked 4801
4801 — Workstation unlocked 4778
4778 — Session reconnected (RDP)
4624 — Successful logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4800
4800 — Workstation locked 4801
4801 — Workstation unlocked 4778
4778 — Session reconnected (RDP)
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.