4625 Security log · Logon/Logoff high severity high volume

Windows Event ID 4625 — An account failed to log on

Logon attempt failed. SubStatus reveals reason: 0xC000006A=wrong password, 0xC0000064=unknown user, 0xC000006D=bad credentials, 0xC000006F=outside allowed hours, 0xC0000234=account locked.

Why event 4625 matters

Password spraying = many accounts, one password, same IpAddress in short window. Brute force = one account, many attempts. SubStatus 0xC000006A + high frequency is the key indicator. Tools: Spray, MSOLSpray, CrackMapExec, Hydra. RDP brute force shows LogonType=10.

How to detect it

Alert: >10 failures from single IpAddress within 5 min targeting different accounts (spray). Alert: >10 failures against single account (brute force). Alert: SubStatus 0xC000006F/0xC0000070. Correlate with 4740 (lockout) and 4648 (explicit creds).

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
TargetUserNameLogonTypeIpAddressWorkstationNameStatusSubStatus

MITRE ATT&CK mapping

Tactic Technique
Credential Access Password Spraying (T1110.003)
Credential Access Password Guessing (T1110.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Failed Logon Spike — Brute Force or Spray
status: stable
description: Cluster of failed logons indicating brute force or password spray
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
    condition: selection | count() by IpAddress > 10
falsepositives:
    - Misconfigured apps with stale credentials
    - Vulnerability scanners
level: medium
tags:
    - attack.credential_access
    - attack.t1110.003
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4625   // An account failed to log on
| project TimeGenerated, Computer, TargetUserName, LogonType, IpAddress, WorkstationName, Status, SubStatus
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4625
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An account failed to log on — add EventData fields: TargetUserName, LogonType, IpAddress, WorkstationName`
Hunt event 4625 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related Logon/Logoff events

4624 An account was successfully logged on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4625?

An account failed to log on. Logon attempt failed. SubStatus reveals reason: 0xC000006A=wrong password, 0xC0000064=unknown user, 0xC000006D=bad credentials, 0xC000006F=outside allowed hours, 0xC0000234=account locked.

Which log records event 4625?

Event 4625 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4625?

Event 4625 is associated with: Password Spraying (T1110.003), Password Guessing (T1110.001).

How do you detect activity around event 4625?

Alert: >10 failures from single IpAddress within 5 min targeting different accounts (spray). Alert: >10 failures against single account (brute force). Alert: SubStatus 0xC000006F/0xC0000070. Correlate with 4740 (lockout) and 4648 (explicit creds).