Aegis
All events
// Operations

Authentication Failure

Pre-authentication failed for gsimmons from 10.4.12.26 (status 0x18: bad password)

EVT-016EFDLow

Same principal

Other activity for gsimmons around this time

Hunt
TimeEventSeverityHost
2026-09-03 16:13:17ZAuthentication SuccessInfoWS-FIN-006
2026-09-03 16:50:43ZAuthentication SuccessInfoWS-FIN-009
2026-09-03 17:05:16ZAuthentication SuccessInfoWS-FIN-011
2026-09-03 17:05:18ZAuthentication SuccessInfoWS-FIN-010
2026-09-03 17:34:23ZAuthentication SuccessInfoWS-FIN-001

Same source address

Other activity from 10.4.12.26

TimeEventUserCountry
2026-09-03 16:19:23ZNetwork Allow——
2026-09-03 17:06:24ZNetwork Allow——
2026-09-03 17:14:57ZAuthentication SuccesslgarciaUSA
2026-09-03 17:28:09ZAuthentication SuccessdnakamuraUSA

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_FAILURE
Action
logon
Status
failure
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.