Account locked out after too many failed attempts. CallerComputerName=source machine, TargetUserName=locked account.
Multiple accounts locked from same CallerComputerName = password spray in progress. Single account repeatedly locked = targeted brute force. Mass lockouts (>10 accounts in <5 min) = automated spray or worm propagation.
Alert: >3 accounts locked within 10 min from same CallerComputerName. Alert: lockout of any admin or service account. Correlate CallerComputerName with 4625 events. Lockout storms (>10 accounts in <5 min) = active attack.
TargetUserNameSubjectUserNameCallerComputerName | Tactic | Technique |
|---|---|
| Credential Access | Brute Force (T1110) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Account Lockout Spike
status: stable
description: Multiple account lockouts from same source — possible password spray
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4740
condition: selection | count() by CallerComputerName > 3
falsepositives:
- Misconfigured service with wrong credentials
level: high
tags:
- attack.credential_access
- attack.t1110SecurityEvent
| where EventID == 4740 // A user account was locked out
| project TimeGenerated, Computer, TargetUserName, SubjectUserName, CallerComputerName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4740
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A user account was locked out — add EventData fields: TargetUserName, SubjectUserName, CallerComputerName`A user account was locked out. Account locked out after too many failed attempts. CallerComputerName=source machine, TargetUserName=locked account.
Event 4740 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4740 is associated with: Brute Force (T1110).
Alert: >3 accounts locked within 10 min from same CallerComputerName. Alert: lockout of any admin or service account. Correlate CallerComputerName with 4625 events. Lockout storms (>10 accounts in <5 min) = active attack.