Multiple failed Administrator logons from external IP followed by success on workstation-07
HighBetween 2026-09-03T22:41:03Z and 2026-09-03T22:42:51Z workstation-07 recorded three successive LogonFailed events for account 'administrator' from remote IP 196.251.83.4, immediately followed (~1m48s later) by a LogonSuccess for the same account and remote IP. This pattern (rapid failures then success) from an external/public IP is indicative of a brute-force or credential-stuffing attempt that succeeded, or an attacker validating stolen credentials. The account is high-value ('administrator') and the source IP appears external, increasing suspicion of compromise or unauthorized access.
Credential Access / Initial Access (T1110, T1078)Recommendations
- create incident
- pivot
- monitor
Indicators of Compromise
- Account: administrator
- Device: workstation-07
- Remote IP: 196.251.83.4
- Timestamps: 2026-09-03T22:41:03Z, 2026-09-03T22:41:09Z, 2026-09-03T22:41:15Z, 2026-09-03T22:42:51Z
Assumptions: log source is DeviceLogonEvents only; logon type (interactive/remote/remote interactive) not provided. 196.251.83.4 appears to be an external/public IP — verify with IP ownership lookup. Immediate next steps: block or rate-limit the source IP if legitimate prevention is desired, force reset of the 'administrator' password/keys, check for post-auth activity on workstation-07 (process creation, new services, network connections), hunt for same source IP or account activity across other hosts, and review privileged account access logs and MFA status for the administrator account.