nerdexam
GIAC

GCIH · Question #722

A spike in Event ID 4625 is found in Windows event logs. Looking at individual accounts across the domain, no more than 5 failed logins are found for any single account. What is a likely explanation f

The correct answer is B. There was a password spraying attack on the organization. A spike in Event ID 4625 distributed across many accounts with very few failures per account is the hallmark pattern of a password spraying attack.

Incident Response & Cyber Kill Chain

Question

A spike in Event ID 4625 is found in Windows event logs. Looking at individual accounts across the domain, no more than 5 failed logins are found for any single account. What is a likely explanation for this?

Options

  • AThe organization's passwords have been exposed online
  • BThere was a password spraying attack on the organization
  • CThere was a pass-the-hash attack on the organization
  • DThe organization experienced an attempted Kerberoasting attack

How the community answered

(38 responses)
  • A
    5% (2)
  • B
    82% (31)
  • C
    11% (4)
  • D
    3% (1)

Why each option

A spike in Event ID 4625 distributed across many accounts with very few failures per account is the hallmark pattern of a password spraying attack.

AThe organization's passwords have been exposed online

Exposed credentials online would more likely result in targeted credential stuffing with higher failure counts on specific accounts, not a broad low-count distribution.

BThere was a password spraying attack on the organizationCorrect

Password spraying attacks deliberately attempt only a small number of passwords (often one to three) against a large number of accounts to stay below account lockout thresholds. This produces a high volume of 4625 events spread thinly across many accounts, exactly matching the observed pattern of no more than 5 failures per account.

CThere was a pass-the-hash attack on the organization

Pass-the-hash attacks use captured NTLM hashes for authentication and do not typically generate 4625 logon failure events in the same distributed pattern.

DThe organization experienced an attempted Kerberoasting attack

Kerberoasting requests service tickets via Kerberos and generates Event ID 4769, not widespread 4625 logon failures.

Concept tested: Identifying password spraying via Windows event logs

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

Topics

#password spraying#Event ID 4625#Windows event logs#anomaly detection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice