Windows Event 4776 — NTLM Credential Validation

What This Means

Analyze Windows Event 4776 to monitor NTLM authentication attempts. Detect pass-the-hash attacks, legacy protocol abuse, and credential validation failures across your domain.

Example Log

The computer attempted to validate the credentials for an account.

Authentication Package:  MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:           admin
Source Workstation:      WORKSTATION07
Error Code:              0xC000006A
Status:                  0xC000006D

Indicators of Suspicious Activity

• Error Code 0xC000006A (bad password) in high volume — brute force via NTLM
• NTLM authentication where Kerberos should be used (potential pass-the-hash)
• Authentication attempts from workstations not in the domain or from unknown hosts
• Source Workstation names that do not match any known asset in inventory
• Logon Account targeting service accounts or built-in admin accounts
• High frequency of 4776 events compared to normal baseline

How to Investigate

1. Identify the Source Workstation and verify it in your asset inventory
2. Check the Error Code to understand the failure reason
3. If Error Code is 0x0 (success) with NTLM, investigate why Kerberos was not used
4. Correlate with Event 4624 on the target system to find the logon details
5. Check if the Logon Account has been involved in other suspicious events
6. Investigate whether the source workstation may be compromised

Recommended Mitigations

• Restrict NTLM authentication using Group Policy (Network Security: Restrict NTLM)
• Enable NTLM auditing before blocking to understand impact
• Require Kerberos authentication wherever possible
• Implement credential guard on endpoints to prevent NTLM hash theft
• Monitor Event 4776 failures as a brute force indicator
• Block NTLM at the domain level and create exceptions only where absolutely necessary

Related Attack Patterns

Frequently Asked Questions