Understand the event.
Find your next step.
Windows and Sysmon events, explained. Find the fields that matter, understand the context, and follow a more informed investigation.
An account failed to log on
Windows Security · Audit failure
- LogonType
- 3 / Network
- Status
- 0xC000006D
- SubStatus
- 0xC000006A
An event, a field, a question.
Start with an event
A number. A meaning. A way forward.
Failed logon
Decode failure codes, identify the source, and separate mistakes from suspicious patterns.
Process access
Understand GrantedAccess, LSASS access, and why process context matters.
DNS query
Connect a DNS query to its process and investigate unusual resolution activity.
Account lockout
Find the caller computer and investigate repeated account lockouts.
Put the pieces together
Go beyond a single event.
Follow the logon trail
Failed attempts, successful logons, and account changes. Understand which events to examine together.
Explore the guide ↗Investigate credential access
Inspect LSASS access and credential-store activity, with context for legitimate tools and false positives.
Explore the guide ↗Look for a foothold
Examine scheduled tasks and persistence mechanisms. Follow the evidence before drawing a conclusion.
Explore the guide ↗Follow your question
Explore by investigation.
A closer look, locally
Have an event open in Event Viewer?
Copy its details as XML. Decode the fields in your browser, with your values beside the reference explanation.