Detect Windows Password Spraying with Event ID 4625

title: Windows Password Spraying via Failed Logon (4625)
id: c47b2e91-5a83-4d16-9f27-8b3e1c6a049d
status: experimental
description: >
  Detects password spraying and brute force against Windows or Active Directory.
  Event ID 4625 is a failed logon; the SubStatus code distinguishes a bad password
  (0xC000006A) from a non-existent account (0xC0000064), which separates spraying
  from username enumeration. LogonType 3 indicates the attempt arrived over the
  network rather than at the console.
references:
  - https://attack.mitre.org/techniques/T1110/003/
  - https://attack.mitre.org/techniques/T1078/002/
author: LogTriage
date: 2026/08/04
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    LogonType: 3
  auth_failure:
    # 0xC000006A bad password (valid user) | 0xC0000064 user does not exist
    # 0xC0000072 account disabled but real
    SubStatus:
      - '0xC000006A'
      - '0xC0000064'
      - '0xC0000072'
  timeframe: 15m
  condition: selection and auth_failure | count(TargetUserName) by IpAddress >= 8
falsepositives:
  - Service account with a stale password in a scheduled task or app pool
  - Stale cached credential on a phone or laptop after a password change
  - Health probe or load balancer authenticating with an expired credential
level: high
tags:
  - attack.credential_access
  - attack.t1110.003
  - attack.t1078.002

What this rule detects

Event ID 4625 is a failed logon on Windows. A handful is normal; a burst is not. This rule targets the pattern that matters most in Active Directory: password spraying, where an attacker tries one or two common passwords against many accounts, specifically to stay under the per-account lockout threshold.

The rule fires when a single source IP produces failed logons against 8 or more distinct usernames within 15 minutes.

Detection logic

The core selection is EventID: 4625 with LogonType: 3 — a failed network logon. Console mistyping (type 2) and cached credentials (type 11) are excluded because they are dominated by genuine user error.

The auth_failure selection then requires one of three SubStatus codes. They are grouped into a single selection because any of them confirms a real authentication failure, but each tells you something different about what the attacker is learning:

SubStatus	Meaning	What it tells you
0xC000006A	Bad password, valid username	Spraying against confirmed-real accounts
0xC0000064	Username does not exist	Enumeration — working a wordlist
0xC0000072	Account disabled but real	Found a stale account; may pivot to others

The aggregation is the important part: count distinct TargetUserName per IpAddress, not failures per account. Spraying is engineered so no single account accumulates enough failures to lock out — a per-account rule is blind to it by construction. Counting breadth rather than depth is what makes the attack visible.

Validated against a real sample

Validated against windows_brute_force.xml (shipped with LogTriage): repeated 4625 events from 185.220.101.45 against DC01.contoso.com, targeting administrator and other accounts in the CONTOSO domain, with Status 0xC000006D / SubStatus 0xC000006A and LogonType 3 — network-delivered password guessing against valid accounts on a domain controller.

The rule fires on that sample and stays silent on the matching benign log, which contains only 4624 (successful logon), 4672 (special privileges), 4688 (process creation), 4768 and 4776 — no 4625 events at all.

False positives

Almost all real-world 4625 noise is a stale credential, not an attack, and it has a distinctive shape: very high volume against a single account from a single host, repeating indefinitely. Scheduled tasks, IIS application pools, and service accounts after a password rotation are the classic sources.

Because this rule keys on the number of distinct usernames, that noise does not trigger it — one account repeated 500 times still counts as one username. That is the main reason to count breadth rather than volume.