Aegis
All events
// Operations

Authentication Failure

Pre-authentication failed for kthompson from 10.4.12.27 (status 0x18: bad password)

EVT-900668Low

Same principal

Other activity for kthompson around this time

Hunt
TimeEventSeverityHost
2026-09-03 20:05:22ZAuthentication SuccessInfoWS-FIN-008
2026-09-03 20:11:46ZAuthentication SuccessInfoWS-FIN-012
2026-09-03 20:13:45ZAuthentication SuccessInfoWS-FIN-002
2026-09-03 21:12:27ZAuthentication SuccessInfoWS-FIN-010

Same source address

Other activity from 10.4.12.27

TimeEventUserCountry
2026-09-03 19:46:23ZAuthentication SuccessekowalskiUSA
2026-09-03 20:11:46ZAuthentication SuccesskthompsonUSA
2026-09-03 20:18:27ZNetwork Allow——
2026-09-03 20:34:19ZAuthentication SuccessbpatelUSA
2026-09-03 20:38:25ZAuthentication SuccessgsimmonsUSA

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_FAILURE
Action
logon
Status
failure
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.