Question

A CySA analyst reviews Windows Security logs on a domain controller and finds hundreds of Event ID 4625 entries from a single internal workstation. Each entry shows 'Logon Type: 3' with a different domain username in the Account Name field, all occurring within a two-minute window. Which conclusion is best supported by these indicators?

Accepted Answer

An attacker on the workstation is conducting a network-based password spraying or brute-force attack against multiple domain accounts

Answer

A user is repeatedly mistyping their local console password at the workstation

Answer

A scheduled service on the domain controller failed to start due to an expired service account

Answer

Kerberos ticket-granting tickets are expiring normally during routine authentication