EVID 4625 : Logon/Logoff Events (Part 2) (Security)

Event Details

Event Type	Audit Special Logon
Event Description	4625(F) : An account failed to log on.
Event ID	4625

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	<vendorinfo>	N/A
EventID	<vmid>	<vmid>
Version	<version>	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	N/A	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	<processid>	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
SubjectUserSid	N/A	N/A
SubjectUserName	<login>	N/A
SubjectDomainName	<domainorigin>	N/A
SubjectLogonId	<session>	N/A
Client Address	<sip>	N/A
TargetUserName	N/A	<domainorigin>, <login>, <tag1>
TargetDomainName	N/A	<domainorigin>
Status	N/A	<responsecode>, <tag2>
SubStatus	N/A	<responsecode>, <tag2>
TargetLogonId	N/A	N/A
LogonType	N/A	<sessiontype>, <tag3>
LogonProcessName	N/A	<object>
AuthenticationPackageName	N/A	<objectname>
KeyLength	N/A	<size>
ProcessId	N/A	<processid>
ProcessName	N/A	<process>
IpAddress	N/A	<sip>
IpPort	N/A	<sport>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1010552	Logon/Logoff Events	Base Rule	Windows Audit Failure Event	Other Audit Failure

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011068	V 2.0 : EVID 4625 : Use Account Logon Failure	Base Rule	User Logon Failure	Authentication Failure
	V 2.0 : Computer Account Logon Failure-Bad Usrname	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : Computer Account Logon Failure-Bad Pwd	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : Comp Acc Logon Failure - Expired Password	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : Comp Acc Logon Failure - Disabled Account	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : Comp Acc Logon Failure - Clock Out Of Sync	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : Comp Acc Logon Failure - Expired Account	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : Comp Acc Logon Failure - Password Change	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : Comp Acc Logon Failure - Locked Account	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Computer Account Logon Failure	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : User Account Logon Failure - Bad Username	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
	V 2.0 : User Account Logon Failure - Bad Password	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
	V 2.0 : Usr Acc Logon Failure - Outside Logon Hrs	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 : Usr Acc Logon FailureUnauth Workstation	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 : Usr Acc Logon Failure - Expired Password	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
	V 2.0 : Usr Acc Logon Failure - Disabled Account	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
	V 2.0 : Usr Acc Logon Failure - Clock Out Of Sync	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 : Usr Acc Logon Failure - Expired Account	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
	V 2.0 : Usr Acc Logon FailurePwd Change Required	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 : Usr Acc Logon Failure - Locked Account	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 3: User Locked	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 4: User Locked	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 9: User Locked	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 3: User Locked	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 4: User Locked	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 9: User Locked	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 5: User Locked	Sub Rule	Service Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 5: User Locked	Sub Rule	Service Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 10:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 11:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 2:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 7:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 8:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 10:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 11:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 7:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 8:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 2:User Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
	V 2.0 : EVID 4625 : Usr Logon Type 4: No Such User	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : Usr Logon Type 9: No Such User	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 3: Wrong Pswd	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 4: Wrong Pswd	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 9: Wrong Pswd	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : Usr Logon Type 3: Bad Creden	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : Usr Logon Type 4: Bad Creden	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : Usr Logon Type 9: Bad Credent	Sub Rule	Authentication Failure Activity	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Typ 3: No Such User	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Typ 4: No Such User	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Typ 9: No Such User	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : System Logon Typ 3: Wrong Pswd	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : System Logon Typ 4: Wrong Pswd	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : System Logon Typ 9: Wrong Pswd	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 10: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 11: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 2: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 3: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 4: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 7: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 8: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 9: Bad Credent	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 5: No Such User	Sub Rule	Service Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Usr Logon Type 5: No Such User	Sub Rule	Service Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : Sys Logon Type 5: Wrong Pswd	Sub Rule	Service Logon Failure	Authentication Failure
	V 2.0 : EVID 4625 : User Logon Type 5: Wrong Pswd	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 5: Bad Credent	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 5: Bad Credent	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : Usr Logon Type 3: No Such User	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : Usr Logon Type 10: Bad Credent	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : Usr Logon Type 11: Bad Credent	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: Bad Credent	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: Bad Credent	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: Bad Credent	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 10: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 11 : Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 2: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 7: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 8: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 10: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 11: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: Wrong Pswd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 10: No Such Usr	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 11: No Such Usr	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 2: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 7: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : Sys Logon Type 8: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : Usr Logon Typ 10: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : Usr Logon Typ 11: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : User Logon Typ 2: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : User Logon Typ 7: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : User Logon Typ 8: No Such User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 3: Account Dis	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 4: Account Dis	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 9: Account Dis	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 3: Clock Out O	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 4: Clock Out O	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 9: Clock Out O	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 3: No Logon Ri	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 4: No Logon Ri	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 9: No Logon Ri	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 3: Account D	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 4: Account D	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 9: Account D	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 10: Clock Ou	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 2: Clock Out	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 3: Clock Out	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 4: Clock Out	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 7: Clock Out	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 8: Clock Out	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 9: Clock Out	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 10: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 11: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 2: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 3: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 4: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 7: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 8: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 9: No Logon	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 5: Account D	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 5: Account Dis	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 5: Clock Out	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 5: Clock Out O	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 5: No Logon	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 5: No Logon Ri	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 10: Clock Out	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 11: Clock Out	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: Clock Out O	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: Clock Out O	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: Clock Out O	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 10: No Logon R	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 11: No Logon R	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: No Logon Ri	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: No Logon Ri	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: No Logon Ri	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 10: Account	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 11: Account	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 2: Account D	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 7: Account D	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 8: Account D	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 10: Account Di	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 11: Account Di	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: Account Dis	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: Account Dis	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: Account Dis	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 10: Account	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 11: Account	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 2: Account E	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 3: Account E	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 4: Account E	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 5: Account E	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 7: Account E	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 8: Account E	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 9: Account E	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 10: Account Ex	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 11: Account Ex	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: Account Exp	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 3: Account Exp	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 4: Account Exp	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 5: Account Exp	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: Account Exp	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: Account Exp	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 9: Account Exp	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 10: Change P	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 11: Change P	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 2: Change Pa	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 3: Change Pa	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 4: Change Pa	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 5: Change Pa	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 7: Change Pa	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 8: Change Pa	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 9: Change Pa	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 10: Change Pas	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 11: Change Pas	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: Change Pass	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 3: Change Pass	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 4: Change Pass	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 5: Change Pass	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: Change Pass	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: Change Pass	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 10: Unknown	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 11: Unknown	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 2: Unknown R	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 3: Unknown R	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 10: Unknown	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 5: Unknown R	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 7: Unknown R	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 8: Unknown R	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : System Logon Type 9: Unknown R	Sub Rule	Computer Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 10: Unknown Re	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 11: Unknown Re	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 2: Unknown Rea	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 3: Unknown Rea	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 4: Unknown Rea	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 5: Unknown Rea	Sub Rule	Service Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 7: Unknown Rea	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 8: Unknown Rea	Sub Rule	User Logon Failure	Authentication Failure
V 2.0 : EVID 4625 : User Logon Type 9: Unknown Rsn	Sub Rule	Authentication Failure Activity	Authentication Failure

[data-colorid=nacm7rtcfn]{color:#1155cc} html[data-color-mode=dark] [data-colorid=nacm7rtcfn]{color:#3377ee}Event Details

Log Fields and Parsing

Log Processing Settings

LogRhythm Default

LogRhythm Default v2.0

Event Details