SOC Event Lookup
Event ID 4776LogonP1

Windows Event ID 4776: The domain controller attempted to validate credentials (NTLM)

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4776 records NTLM credential validation performed by a domain controller.

Technical Metadata

Technical metadata for Event ID 4776
Event ID4776
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success or Audit Failure
MITRE ATT&CKTA0006 Credential Access / T1110.003 Brute Force: Password Spraying
Key fields to watchLogon Account, Source Workstation, Error Code

Trigger Scenarios

A domain controller logs this event when it validates NTLM credentials for a user or computer account.

Key Fields

Logon Account

The account whose NTLM credentials were validated. Watch for high-volume attempts against many identities.

Source Workstation

The client that requested validation. This identifies the host performing authentication attempts.

Error Code

The validation result. Codes distinguish bad passwords, unknown users, disabled accounts, and other outcomes.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4776
SecurityEvent
| where EventID == 4776
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4776
index=wineventlog source="WinEventLog:Security" EventCode=4776
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4776
dataset = microsoft_windows_raw
| filter edr_event_id = 4776
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4776
title: Windows Security Event ID 4776
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4776
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
Status0x0The credential validation succeeded.A success after a burst of failures from the same workstation can indicate a guessed credential and should be correlated with the resulting 4624 logon. Source
Status0xC000006AThe account exists, but the supplied password is incorrect.The same source workstation producing this status across many accounts is a password-spray pattern after environmental baselining. Source
Status0xC0000064The specified account does not exist.Repeated nonexistent account names are more consistent with account enumeration or stale configuration than confirmed password guessing. Source

MITRE ATT&CK Mapping

  • T1110.003Brute Force: Password Spraying

Detection Notes

T1110.003 spraying through NTLM appears as Error Code 0xC000006A (bad password) across many Logon Account values from one Source Workstation. Error 0xC0000064 instead shows nonexistent-account enumeration. A successful 0x0 validation after either burst should be correlated with 4624 and 4648.

Common False Positives

  • Legacy applications and SMB systems may rely on NTLM by design.
  • Password changes can cause recurring failures from services using old credentials.

Related Events

Sample Log

Sanitized event sample
Logon Account: jsmith
Source Workstation: WS-014
Error Code: 0xC000006A

Frequently Asked Questions

What does Windows Event ID 4776 mean?

Event ID 4776 records an attempt by a computer to validate account credentials using NTLM and includes the account, source workstation, and result status.

Where is Event ID 4776 generated?

For domain credentials it is generated on the authoritative domain controller; for local account validation it is generated on the local computer.

Which 4776 status is useful for password spraying?

Status 0xC000006A means the account exists but the password is wrong; aggregate it across accounts by source workstation and distinguish it from 0xC0000064 unknown-account failures.

Sources