Intermediate level · Module 4: Logging and Detecting Suspicious Activity · Lesson 2 of 3
Reading Sign-In and Security Logs
Spot patterns that suggest an attack.
In this lesson you will
- Recognise password-guessing patterns
- Identify unusual sign-ins
Key concepts
failed sign-insbaselineunusual location or timeaccount lockout
The lesson
Normal activity forms a baseline: a few failed sign-ins a day from typing mistakes. Hundreds of failures in an hour across many accounts suggests password guessing.
A successful sign-in from an unusual country or device, at an odd hour, right after many failures, needs urgent investigation.
In Windows, failed sign-ins appear as Event ID 4625 and successful ones as 4624 in the Security log.
Step by step
- Count failures per hour.
- Find the spike.
- Check for success after failures.
- Write the finding.
Spotting password guessing in sign-in logs
Failed sign-ins per hour reveal a guessing attack at 04:00 — and one success that needs urgent action.
| Hour | Failed sign-ins | Successful sign-ins |
|---|---|---|
| 00:00 | 2 | 0 |
| 01:00 | 1 | 0 |
| 02:00 | 0 | 0 |
| 03:00 | 3 | 0 |
| 04:00 | 148 | 0 |
| 05:00 | 152 | 1 |
| 06:00 | 4 | 2 |
What the data shows
The baseline is 0–4 failures an hour from typing mistakes. 300 failures between 04:00 and 06:00, spread across many accounts, show password guessing.
The single successful sign-in at 05:00, in the middle of the attack and from an unfamiliar location, is the critical finding: one account's password was guessed.
Recommendation
Treat the 05:00 account as compromised: reset its password, sign out all sessions, check forwarding rules and enforce MFA — then enforce MFA for every account so a guessed password alone is not enough.
Practice activity
Analyse the provided sign-in logs and write findings.
Expected result: A finding that identifies the attack window, accounts targeted and any success.
Check your understanding
-
What pattern suggests password guessing?
Show answer
Many failed sign-ins in a short time, often across many accounts.
-
Which Windows event ID records a failed sign-in?
Show answer
4625.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.