Which of the following event logs contains traces of brute force attempts performed by an attacker?

SysEvent.Evt is the System event log, which records OS-level events such as driver failures and service starts - not authentication or logon failures.

WinEvent.Evt is not a standard Windows event log filename; Windows uses SysEvent.Evt, AppEvent.Evt, and SecEvent.Evt as its three primary classic log files.

AppEvent.Evt is the Application event log, which records events generated by software applications and is unrelated to authentication or brute force activity.

SecEvent.Evt is the Windows Security event log, which captures all audit events related to logon and logoff activity, including repeated failed authentication attempts (Event ID 4625 in modern Windows) that are characteristic of brute force attacks. Enabling account logon auditing causes this log to record each failed password attempt with source IP, username, and timestamp. Investigators rely on this log specifically to identify credential-based attack patterns.