Scenario: Adversaries used a small list of commonly used passwords in a password-spraying
attack — one password tried against many different accounts to acquire valid credentials while avoiding the
lockouts that a traditional single-account brute force would trigger. This lab investigates a
T1110.003 password-spray attempt against RDP, using Splunk to trace failed and successful logons,
identify which accounts were compromised, and time the full attack window.
Q1Who was the last logged-in user?
index="t1110-003" "event.code"=4624
answerAdministrator
Q2What is the logon type of the failed logons?
index="t1110-003" "event.code"=4625
answer3
Q3What is the protocol the attacker tried to bruteforce?
index="t1110-003" "event.code"=261
Event 261 logs a connection received by the RDP listener (
Listener RDP-Tcp received a connection).answerRDP
Q4How many users did the attacker succeed in getting their accounts?
index="t1110-003" "event.code"=1149
| dedup winlog.user_data.Param1
| table winlog.user_data.Param1
Event 1149 logs the username parameter directly for every RDP network connection — deduping gives the exact set of accounts reached.
answer6
Q5According to Microsoft, what is the description of the "Sub Status" code for event ID 4625?
index="t1110-003" "event.code"=4625
The raw event shows Sub Status: 0xC000006A, which Microsoft's documentation maps to a bad-password failure rather than a bad-username failure.
answerUser logon with misspelled or bad password
Q6How long did the bruteforce last? (MM:SS)
index="t1110-003" "event.code"=4625
| sort -_time
First failed logon: 4:29:09.460 PM. Last failed logon: 4:34:57.623 PM. 4:34:57 − 4:29:09 = 05:48.
answer05:48
Q7How many minutes passed before the attacker logged into the machine again?
index="t1110-003" "event.code"=4625
index="t1110-003" "event.code"=4624 "winlog.event_data.IpAddress"="192.168.1.60"
Last failed logon: 4:34:57 PM. Next successful logon: 4:46:11 PM. 4:46:11 − 4:34:57 = 11 minutes.
answer11 minutes
Q8What is the name of the policy used to lock the account after a certain number of failed login attempts?
answerAccount Lockout Policy
Investigation Summary
| Item | Value |
|---|---|
| Target Protocol | RDP (3389/TCP) |
| Failed Logon Type | 3 |
| Successful Logon Type | 10 (RDP) |
| Accounts Compromised | 6 |
| Bruteforce Duration | 05:48 |
| Time to Re-login | 11 minutes |
| Final Logged-in User | Administrator |
| Mitigation | Account Lockout Policy |
Lessons learned: Event ID 4625 (failed logon) paired with 4624 (successful logon) is the
core signal for detecting password spray — a burst of 4625s across many distinct usernames in a tight time
window, followed by a 4624 success, is a strong indicator. Event 1149 (RDP network connection) was the fastest
way to enumerate exactly which accounts the attacker ultimately compromised, since it logs the username
parameter directly instead of requiring correlation across events. The Sub Status code inside 4625
(
0xC000006A — bad password vs 0xC0000064 — bad username) is worth alerting on
separately, since a long run of "bad password" failures against valid usernames is a much stronger spray
indicator than random bad usernames. Account Lockout Policy remains the most direct mitigation — capping
failed attempts per account defeats spray-style attacks that deliberately stay under per-account thresholds.