Aegis
All events
// Operations

Authentication Failure

Pre-authentication failed for cdiaz from 10.4.12.29 (status 0x18: bad password)

EVT-F4F008Low

Same principal

Other activity for cdiaz around this time

Hunt
TimeEventSeverityHost
2026-09-04 16:49:23ZAuthentication SuccessInfoWS-FIN-012
2026-09-04 16:57:47ZAuthentication SuccessInfoWS-FIN-009
2026-09-04 17:14:10ZAuthentication SuccessInfoWS-FIN-001
2026-09-04 17:18:35ZAuthentication SuccessInfoWS-FIN-001
2026-09-04 17:52:20ZAuthentication SuccessInfoWS-FIN-005
2026-09-04 18:02:33ZAuthentication SuccessInfoWS-FIN-005
2026-09-04 18:12:47ZAuthentication SuccessInfoWS-FIN-004
2026-09-04 18:15:57ZAuthentication SuccessInfoWS-FIN-007
2026-09-04 18:18:28ZCloud Api CallInfo—
2026-09-04 18:20:22ZAuthentication SuccessInfoWS-FIN-010

Same source address

Other activity from 10.4.12.29

TimeEventUserCountry
2026-09-04 16:27:09ZAuthentication SuccessekowalskiUSA
2026-09-04 17:25:45ZNetwork Allow——

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_FAILURE
Action
logon
Status
failure
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.