Windows Event ID 4771 — Kerberos Pre-authentication Failed

MITRE ATT&CK

Why It Matters

4771 is the primary Kerberos brute-force and password spray indicator. Unlike NTLM failures (Event 4625), 4771 fires specifically on domain controllers for Kerberos authentication — which means high-volume 4771 events targeting domain accounts from a single IP point directly at credential attacks against Active Directory. Failure code 0x18 (bad password) in bulk is the clearest signal. 4771 is also useful for detecting Kerberos enumeration: failure code 0x6 (no such user) reveals whether an attacker is probing for valid account names before attempting passwords.

Key Fields

Investigation Tips

1. 1.Bulk 4771 with failure code 0x18 from a single Client Address = Kerberos brute-force. Same pattern across many Account Names = password spray.
2. 2.Failure code 0x6 (no such user) in volume from one IP = account enumeration — attacker is probing for valid usernames before launching credential attacks.
3. 3.Correlate with 4768 (TGT request) from the same account and Client Address — a successful 4768 shortly after 4771 failures confirms a credential was cracked.
4. 4.Check for Event 4740 (account lockout) on accounts with high 4771 volume — lockouts confirm brute-force is triggering the lockout threshold.
5. 5.4771 does not fire for NTLM authentication — if you see a suspicious IP but no 4771, check 4625 for NTLM-protocol failures from the same source.
6. 6.Clock skew errors (0x25) from unexpected hosts can indicate an attacker trying to authenticate from a machine outside your time synchronization boundary.

Detection Logic

// Kerberos brute force: 10+ bad-password failures against one account in 5 min
SecurityEvent
| where EventID == 4771
| where FailureCode == "0x18"
| summarize FailCount=count() by TargetAccount, IpAddress, bin(TimeGenerated, 5m)
| where FailCount >= 10
| sort by TimeGenerated desc

// Account enumeration: one IP generating 5+ "no such user" failures in 10 min
SecurityEvent
| where EventID == 4771
| where FailureCode == "0x6"
| summarize Accounts=dcount(TargetAccount) by IpAddress, bin(TimeGenerated, 10m)
| where Accounts >= 5
| extend Alert = "Kerberos enumeration — probing for valid account names"
| sort by TimeGenerated desc

Related Event IDs