Aegis
All events
// Operations

Authentication Failure

Pre-authentication failed for ekowalski from 10.4.12.40 (status 0x18: bad password)

EVT-A7493DLow

Same principal

Other activity for ekowalski around this time

Hunt
TimeEventSeverityHost
2026-09-04 16:27:09ZAuthentication SuccessInfoWS-FIN-006
2026-09-04 16:43:35ZAuthentication SuccessInfoWS-FIN-005
2026-09-04 17:45:29ZProcess ExecutionHighWS-FIN-004
2026-09-04 17:46:09ZNetwork AllowMedium—
2026-09-04 17:47:04ZPersistence CreatedHighWS-FIN-004
2026-09-04 17:52:54ZAuthentication FailureLowWS-FIN-004
2026-09-04 18:02:03ZAuthentication SuccessInfoWS-FIN-012

Same source address

Other activity from 10.4.12.40

TimeEventUserCountry
2026-09-04 16:36:21ZCloud Api Calllgarcia—

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_FAILURE
Action
logon
Status
failure
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.