Lion Cipher Lab
Tell username enumeration from password spraying with Event 4625 status codes
- SOC Analyst / Blue Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every Windows SOC has a 'too many failed logons' alert, and most of them only count. A count cannot tell you WHAT is happening: someone guessing usernames to learn who works here, someone trying one common password against every account so nobody locks out, someone hammering one account until it locks, or a backup job still using last month's password. Those four need four different responses, from 'block the address and expect a spray next' to 'open a ticket with the app team'. The answer is already inside every failed-logon event Windows writes: a Status and SubStatus code that says exactly…
What you'll learn
- Reading Windows Security Event 4625 (an account failed to log on) field by field: TargetUserName, Status, SubStatus, LogonType, IpAddress
- Decoding NTSTATUS failure codes: 0xC000006A (bad password, the account EXISTS), 0xC0000064 (no such user), 0xC0000234 (locked out), 0xC0000072 (disabled) and the rest
- Telling four attack and noise shapes apart by their code mix: username enumeration, password spraying, brute force, and a stale service-account credential
- Measuring a naive failure-count rule against a SubStatus-aware classifier with precision, recall and 'right type' on labelled data
- Using asset context (known NAT / gateway addresses) to remove a false positive, and naming what that context costs you
Steps in this lab
- Why 'count the failures' is not enough
- Read one 4625: the five fields that matter
- The codes, decoded
- Generate a labelled day of failed logons
- Write the naive rule and the SubStatus-aware classifier
- Read the per-source table
- Score the three rules
- The judgment: what the asset list costs, and what each type should trigger
- Where 4625 is NOT the event: domain controllers and Kerberos
- Optional: read your own 4625s with PowerShell
- Where this goes next