A sign-in from somewhere new
An account signed in from a place or a device you did not expect. Write down what the log actually says before you reset a password or wake the user.
Write the facts
The useful record names the account, the time, the source, and whether the sign-in succeeded. A city name in a chat message is not that record. If you cannot point at those four fields, you are not ready to call it a compromise.
Keep the note next to the event id. A later reader should be able to open the same line and agree with you, or disagree for a reason you wrote down.
Password, prompt, or token
A password check and a token check are different events. A successful password means the secret matched at that moment. A token can be shown again later without anyone typing the password.
MFA sits between them: a push, a code, or a number the user must match. A tired person accepting a stack of pushes is a different failure from a password that was guessed. Read which of those happened before you decide what to revoke.
What the event id is for
On Windows, 4624 is a success. The logon type says whether it was the console, the network, Remote Desktop, or a service. 4625 is a failure. Failures and then one success from a new address are the pair to read together, not a single line in isolation.
The same idea shows up without a Windows event id. Two successes too far apart for one person to have traveled are a question about the account, not a map of an attack. The lesson on impossible travel is that question.
Change the thing the record names
Resetting every password because one city looks new creates an outage, and it may leave a still-valid token alone. Disable the account or revoke its sessions when a record supports that, and say which record.
Practice the call on the labs. They give you a push queue and a token. They do not give you a production directory.
Open next
- 01Windows Event ID 4624 logon types explained: 2, 3, 5, 7, 10, and 11Lesson
- 02How to read Windows Event ID 4625: failed logons, status codes, and logon typesLesson
- 03Impossible travel: sign-ins too far apart to be one personLesson
- 04MFA fatigue: repeated push prompts and how number matching stops themLesson
- 05Active Directory defenseWorkbench
- 06Identity defenseWorkbench
- 07MFA fatigue triage queueLab
- 08JWT inspectorLab