4776 Security log · Kerberos Authentication Service medium severity high volume

Windows Event ID 4776 — The domain controller attempted to validate the credentials for an account (NTLM)

DC validated credentials via NTLM. ErrorCode: 0x0=success, 0xC000006A=wrong password, 0xC000006D=bad creds, 0xC0000064=unknown user, 0xC0000234=locked.

Why event 4776 matters

NTLM brute force and spray. Pass-the-Hash generates 4776 with 0x0 — indistinguishable from legit NTLM auth. Monitor Workstation field for source. Impacket and Metasploit generate NTLM auth. In Kerberos-first environments, unexpected NTLM spikes are high signal.

How to detect it

Alert: >10 ErrorCode=0xC000006A from same Workstation in 5 min. Alert: NTLM from non-Windows systems (null or Linux hostnames). Alert: NTLM from internet-facing IPs. Baseline NTLM traffic — deviations are suspicious.

Log source
Security
Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Fields to pivot on
TargetUserNameWorkstationStatus

MITRE ATT&CK mapping

Tactic Technique
Credential Access Brute Force (T1110)
Lateral Movement Pass the Hash (T1550.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: NTLM Auth Failure Spike on DC
status: stable
description: Repeated NTLM failures on DC indicating brute force or spray
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4776
        ErrorCode: '0xC000006A'
    condition: selection | count() by Workstation > 10
falsepositives:
    - Services with stale credentials
level: medium
tags:
    - attack.credential_access
    - attack.t1110
    - attack.t1550.002
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4776   // The domain controller attempted to validate the credentials for an account (NTLM)
| project TimeGenerated, Computer, TargetUserName, Workstation, Status
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4776
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The domain controller attempted to validate the credentials for an account (NTLM) — add EventData fields: TargetUserName, Workstation, Status`
Hunt event 4776 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Kerberos Authentication Service events

4768 A Kerberos authentication ticket (TGT) was requested 4769 A Kerberos service ticket was requested 4770 A Kerberos service ticket was renewed 4771 Kerberos pre-authentication failed 4772 A Kerberos authentication ticket request failed 4773 A Kerberos service ticket request failed 4774 An account was mapped for logon 4775 An account could not be mapped for logon 4777 The domain controller failed to validate the credentials for an account 4820 A Kerberos Ticket-Granting-Ticket (TGT) was denied because the device does not meet the access control restrictions 4821 A Kerberos service ticket was denied because the user, device, or both do not meet the access control restrictions 4822 NTLM authentication failed because the account was a member of the Protected Users group

Frequently asked questions

What is Windows Event ID 4776?

The domain controller attempted to validate the credentials for an account (NTLM). DC validated credentials via NTLM. ErrorCode: 0x0=success, 0xC000006A=wrong password, 0xC000006D=bad creds, 0xC0000064=unknown user, 0xC0000234=locked.

Which log records event 4776?

Event 4776 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4776?

Event 4776 is associated with: Brute Force (T1110), Pass the Hash (T1550.002).

How do you detect activity around event 4776?

Alert: >10 ErrorCode=0xC000006A from same Workstation in 5 min. Alert: NTLM from non-Windows systems (null or Linux hostnames). Alert: NTLM from internet-facing IPs. Baseline NTLM traffic — deviations are suspicious.