Ravi Sir's Cyber Security Cards › Interview Cards
What does Event ID 4625 tell you?
What does Event ID 4625 tell you? Event ID 4625 is a failed Windows logon. Many 4625s then a 4624 from the same IP can mean a brute-force that finally worked. “I correlate failed logons with any later success from the same source and odd hours.” It’s the pattern, not a single 4625, that signals an a
Read card text
What this card says
Short answer
Event ID 4625 is a failed Windows logon.
Example
Many 4625s then a 4624 from the same IP can mean a brute-force that finally worked.
Say it in the interview
“I correlate failed logons with any later success from the same source and odd hours.”
Why it matters
It’s the pattern, not a single 4625, that signals an attack.
Learn more in the lesson: 47.3 Linux, Logs and Windows Event IDs