Aegis
All events
// Operations

Authentication Failure

Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password)

EVT-A105C0Low

Same principal

Other activity for ivanov around this time

Hunt
TimeEventSeverityHost
2026-09-02 20:59:42ZAuthentication SuccessInfoWS-FIN-011
2026-09-02 21:21:14ZAuthentication FailureLowWS-FIN-008
2026-09-02 21:48:26ZAuthentication SuccessInfoWS-FIN-005

Same source address

Other activity from 10.4.12.34

TimeEventUserCountry
2026-09-02 20:59:42ZAuthentication SuccessivanovUSA
2026-09-02 21:41:36ZAuthentication SuccesslgarciaUSA
2026-09-02 22:01:03ZAuthentication SuccessekowalskiUSA
2026-09-02 22:03:12ZAuthentication FailuregsimmonsUSA

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_FAILURE
Action
logon
Status
failure
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.