Nathan is examining the security event log on a file server that contains sensitive data. He finds a number of Event ID 1234s with substatus code 0xC000006A. There are 4 or less failures against any i

Rainbow table attacks crack hashes offline by precomputed lookups and never generate authentication failure events in a security log.

Password spraying deliberately tries a single common password (or a very small set) against a large number of accounts to stay below lockout thresholds, which is exactly what low per-account failure counts indicate. The substatus 0xC000006A confirms a bad password was supplied, and the distribution across accounts rather than concentration on one account distinguishes spraying from brute force.

Brute force attacks target a single account repeatedly with many password attempts, which would produce a high failure count on individual accounts - the opposite of what is observed here.

Pass-the-hash attacks authenticate using a stolen NTLM hash directly and succeed on the first attempt, so they do not produce wrong-password failure events with substatus 0xC000006A.