Question

While reviewing Windows Security logs on a critical file server, an analyst notices a spike in Event ID 4672 (Special privileges assigned to new logon) tied to a standard user account named 'jhaley' that historically only performs document edits. The events occur at 02:14 AM, well outside the user's normal hours, and are immediately followed by Event ID 4688 entries spawning 'net.exe' and 'reg.exe'. Which conclusion is best supported by these indicators?

Accepted Answer

A standard account received administrator-equivalent privileges at logon and is being used to run administrative commands, suggesting account compromise or privilege escalation

Answer

The 4672 events are expected noise generated for every interactive logon and can be safely ignored

Answer

The activity indicates a brute-force password attack, which should be confirmed by counting Event ID 4625 failures

Answer

The server clock is out of sync, so the timestamps and event correlation cannot be trusted