Question

While reviewing a Windows Security event log on a domain controller, an analyst notices dozens of Event ID 4625 entries generated within a two-minute window, all referencing the same target account 'svc_backup' but originating from a single remote workstation. Each entry lists a Failure Reason of 'Unknown user name or bad password.' What type of event does this log pattern most directly indicate?

Accepted Answer

A password brute-force or guessing attempt against the service account

Answer

A successful privilege escalation using stolen service account credentials

Answer

A normal account lockout caused by an expired Kerberos ticket

Answer

A pass-the-hash attack that bypassed password authentication entirely