{"id":22166,"date":"2026-09-26T12:11:58","date_gmt":"2026-09-26T08:41:58","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%aa%d8%ad%d9%84%db%8c%d9%84-failed-login-%d8%af%d8%b1-windows-server\/"},"modified":"2026-09-26T12:34:06","modified_gmt":"2026-09-26T09:04:06","slug":"failed-login-windows","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/security\/failed-login-windows\/","title":{"rendered":"\u062a\u062d\u0644\u06cc\u0644 Failed Login \u062f\u0631 Windows Server"},"content":{"rendered":"\n

<\/p>\n\n\n\n

\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n

\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0646\u0627\u0628\u0639 \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f \u063a\u06cc\u0631\u0645\u062c\u0627\u0632\u060c \u062d\u0645\u0644\u0627\u062a Brute Force\u060c Password Spraying \u0648 \u0645\u0634\u06a9\u0644\u0627\u062a Authentication \u062f\u0631 Windows Server\u060c \u0628\u0631\u0631\u0633\u06cc Failed Login<\/strong>\u0647\u0627 \u062f\u0631 Security Event Log \u0627\u0633\u062a.<\/p>\n\n\n\n

Windows \u0628\u0631\u0627\u06cc Login \u0646\u0627\u0645\u0648\u0641\u0642 \u0645\u0639\u0645\u0648\u0644\u0627\u064b Event:<\/p>\n\n\n\n

4625<\/code><\/pre>\n\n\n\n
\u0631\u0627 \u062b\u0628\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
\u0627\u06cc\u0646 Event \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0645\u0627 \u0642\u0631\u0627\u0631 \u062f\u0647\u062f:<\/p>\n\n\n\n
Username\nDomain\nLogon Type\nSource IP\nSource Port\nWorkstation Name\nAuthentication Package\nFailure Reason\nStatus\nSub Status\nCaller Process<\/code><\/pre>\n\n\n\n
Microsoft \u0627\u0639\u0644\u0627\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f Event ID 4625 \u0628\u0631\u0627\u06cc Logon \u0646\u0627\u0645\u0648\u0641\u0642 \u0631\u0648\u06cc \u0647\u0645\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645\u06cc \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u062a\u0644\u0627\u0634 \u0628\u0631\u0627\u06cc Login \u0631\u0648\u06cc \u0622\u0646 \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u06cc\u0627\u062f \u0645\u06cc\u200c\u06af\u06cc\u0631\u06cc\u0645 \u0686\u06af\u0648\u0646\u0647 Failed Login\u0647\u0627\u06cc Windows Server \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Event Viewer \u0648 PowerShell<\/strong> \u062a\u062d\u0644\u06cc\u0644 \u06a9\u0646\u06cc\u0645\u060c Source IP \u0648 Username\u0647\u0627\u06cc \u0647\u062f\u0641 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u0645\u060c \u0646\u0648\u0639 Login \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0647\u06cc\u0645 \u0648 \u0627\u0644\u06af\u0648\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9\u06cc \u0645\u0627\u0646\u0646\u062f Brute Force \u0631\u0627 \u0627\u0632 \u062e\u0637\u0627\u0647\u0627\u06cc \u0639\u0627\u062f\u06cc Service\u0647\u0627 \u06cc\u0627 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062c\u062f\u0627 \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n
\n\n\n\n
Event ID 4625 \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n
Event:<\/p>\n\n\n\n
4625<\/code><\/pre>\n\n\n\n
\u0628\u0627 \u0639\u0646\u0648\u0627\u0646:<\/p>\n\n\n\n
An account failed to log on<\/code><\/pre>\n\n\n\n
\u0632\u0645\u0627\u0646\u06cc \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 Windows \u0646\u062a\u0648\u0627\u0646\u062f \u06cc\u06a9 Logon Request \u0631\u0627 \u0628\u0627 \u0645\u0648\u0641\u0642\u06cc\u062a \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f.<\/p>\n\n\n\n
\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0639\u0644\u062a \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n
Wrong Password\nUnknown Username\nDisabled Account\nLocked Account\nExpired Account\nUnauthorized Workstation\nMissing Logon Right<\/code><\/pre>\n\n\n\n
\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0648\u062c\u0648\u062f Event 4625 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0628\u0647 \u0645\u0639\u0646\u06cc \u062d\u0645\u0644\u0647 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
\u0645\u0634\u0627\u0647\u062f\u0647 Failed Login \u062f\u0631 Event Viewer<\/h1>\n\n\n\n
\u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
eventvwr.msc<\/code><\/pre>\n\n\n\n
\u0633\u067e\u0633 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
Event Viewer\n   |\n   \u2514\u2500\u2500 Windows Logs\n          |\n          \u2514\u2500\u2500 Security<\/code><\/pre>\n\n\n\n
\u0627\u0632 \u0633\u0645\u062a \u0631\u0627\u0633\u062a:<\/p>\n\n\n\n
Filter Current Log<\/code><\/pre>\n\n\n\n
\u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
\u062f\u0631 \u0642\u0633\u0645\u062a Event ID \u0648\u0627\u0631\u062f \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
4625<\/code><\/pre>\n\n\n\n
\u0627\u06a9\u0646\u0648\u0646 Failed Login\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
\n\n\n\n
\u0645\u0634\u0627\u0647\u062f\u0647 Event 4625 \u0628\u0627 PowerShell<\/h1>\n\n\n\n
\u0631\u0648\u0634 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631:<\/p>\n\n\n\n
Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n} -MaxEvents 50<\/code><\/pre>\n\n\n\n
\u0628\u0631\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u062e\u0644\u0627\u0635\u0647\u200c\u062a\u0631:<\/p>\n\n\n\n
Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n} -MaxEvents 50 |\nSelect-Object TimeCreated,Id,Message<\/code><\/pre>\n\n\n\n
\n\n\n\n
Failed Login\u0647\u0627\u06cc 24 \u0633\u0627\u0639\u062a \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n
Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n    StartTime=(Get-Date).AddHours(-24)\n}<\/code><\/pre>\n\n\n\n
\u0628\u0631\u0627\u06cc 7 \u0631\u0648\u0632 \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n
Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n    StartTime=(Get-Date).AddDays(-7)\n}<\/code><\/pre>\n\n\n\n
\u062f\u0631 Server\u0647\u0627\u06cc \u067e\u0631\u062a\u0631\u0627\u0641\u06cc\u06a9 \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0647\u0645\u06cc\u0634\u0647 StartTime<\/code> \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u062a\u0627 \u062d\u062c\u0645 Query \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u062f.<\/p>\n\n\n\n
\n\n\n\n
\u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0628\u062e\u0634\u200c\u0647\u0627\u06cc Event 4625<\/h1>\n\n\n\n
\u062f\u0627\u062e\u0644 Event \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0686\u0646\u062f \u0642\u0633\u0645\u062a \u0627\u0635\u0644\u06cc \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n
Account For Which Logon Failed<\/h2>\n\n\n\n
\u0627\u06cc\u0646 \u0628\u062e\u0634 \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f Login \u0628\u0631\u0627\u06cc \u0686\u0647 Account\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 \u0628\u0648\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
\u0641\u06cc\u0644\u062f\u0647\u0627\u06cc \u0645\u0647\u0645:<\/p>\n\n\n\n
Account Name\nAccount Domain<\/code><\/pre>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
Account Name: Administrator\nAccount Domain: SERVER01<\/code><\/pre>\n\n\n\n
\n\n\n\n
Network Information<\/h1>\n\n\n\n
\u0628\u0631\u0627\u06cc Login\u0647\u0627\u06cc Remote \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0642\u0633\u0645\u062a\u200c\u0647\u0627:<\/p>\n\n\n\n
Network Information<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
\u0641\u06cc\u0644\u062f\u0647\u0627\u06cc \u0645\u0647\u0645:<\/p>\n\n\n\n
Workstation Name\nSource Network Address\nSource Port<\/code><\/pre>\n\n\n\n
Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f Source Network Address<\/code> \u0622\u062f\u0631\u0633 IP \u0633\u06cc\u0633\u062a\u0645\u06cc \u0627\u0633\u062a \u06a9\u0647 Logon Request \u0627\u0632 \u0622\u0646 \u0622\u0645\u062f\u0647 \u0627\u0633\u062a\u061b 127.0.0.1<\/code> \u0648 ::1<\/code> \u0646\u06cc\u0632 \u0628\u0647 Localhost \u0627\u0634\u0627\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
Source Network Address: 203.0.113.50\nSource Port: 52144<\/code><\/pre>\n\n\n\n
\u0627\u06cc\u0646 IP \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0633\u0631\u0646\u062e\u200c\u0647\u0627 \u0628\u0631\u0627\u06cc Investigation \u0627\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
Process Information<\/h1>\n\n\n\n
Event 4625 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a Process \u0627\u06cc\u062c\u0627\u062f\u06a9\u0646\u0646\u062f\u0647 \u062f\u0631\u062e\u0648\u0627\u0633\u062a Login \u0631\u0627 \u0646\u06cc\u0632 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0647\u062f:<\/p>\n\n\n\n
Caller Process ID\nCaller Process Name<\/code><\/pre>\n\n\n\n
Microsoft \u0627\u0634\u0627\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f Process ID \u0627\u06cc\u0646 Event \u0631\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0628\u0627 Process Creation Event \u0645\u0627\u0646\u0646\u062f 4688<\/code> Correlate \u06a9\u0631\u062f.<\/p>\n\n\n\n
\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
Caller Process Name:\nC:\\Windows\\System32\\winlogon.exe<\/code><\/pre>\n\n\n\n
\u06cc\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Application \u06cc\u0627 Service \u062f\u06cc\u06af\u0631\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a Authentication \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
\n\n\n\n
Logon Type \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n
\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0641\u06cc\u0644\u062f\u0647\u0627\u06cc Event 4625:<\/p>\n\n\n\n
Logon Type<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
Logon Type \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f Authentication \u062f\u0631 \u0686\u0647 Context\u06cc \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
Microsoft \u0645\u0642\u0627\u062f\u06cc\u0631 \u0627\u0635\u0644\u06cc \u0631\u0627 \u0628\u0647 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n\n\n\n
2  = Interactive\n3  = Network\n4  = Batch\n5  = Service\n7  = Unlock\n8  = NetworkCleartext\n9  = NewCredentials\n10 = RemoteInteractive\n11 = CachedInteractive<\/code><\/pre>\n\n\n\n
\n\n\n\n
Logon Type 2<\/h1>\n\n\n\n
Logon Type 2<\/code><\/pre>\n\n\n\n
\u06cc\u0639\u0646\u06cc:<\/p>\n\n\n\n
Interactive Login<\/strong><\/p>\n\n\n\n
\u0645\u0639\u0645\u0648\u0644\u0627\u064b Login \u0645\u0633\u062a\u0642\u06cc\u0645 \u0631\u0648\u06cc Console \u0633\u06cc\u0633\u062a\u0645.<\/p>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
Username \/ Password\n        |\n        v\nWindows Logon Screen<\/code><\/pre>\n\n\n\n
\u0631\u0648\u06cc Windows Server \u0641\u06cc\u0632\u06cc\u06a9\u06cc \u06cc\u0627 VM Console \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u06cc\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n
\n\n\n\n
Logon Type 3<\/h1>\n\n\n\n
Logon Type 3<\/code><\/pre>\n\n\n\n
\u06cc\u0639\u0646\u06cc:<\/p>\n\n\n\n
Network Logon<\/strong><\/p>\n\n\n\n
\u0627\u06cc\u0646 \u0646\u0648\u0639 Login \u0628\u0633\u06cc\u0627\u0631 \u0631\u0627\u06cc\u062c \u0627\u0633\u062a.<\/p>\n\n\n\n
\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647:<\/p>\n\n\n\n
SMB\nShared Folder\nNetwork Resource\nApplication Authentication\nRemote Service<\/code><\/pre>\n\n\n\n
\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f Type 3 \u0627\u0644\u0632\u0627\u0645\u0627\u064b \u0628\u0647 \u0645\u0639\u0646\u06cc Brute Force \u0631\u0648\u06cc RDP \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
Logon Type 4<\/h1>\n\n\n\n
Logon Type 4<\/code><\/pre>\n\n\n\n
\u0645\u0631\u0628\u0648\u0637 \u0628\u0647:<\/p>\n\n\n\n
Batch<\/strong><\/p>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0628\u0639\u0636\u06cc Scheduled Task\u0647\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0627\u06cc\u0646 Logon Type \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n
\u0627\u06af\u0631 Password \u06cc\u06a9 Service Account \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0645\u0627 Scheduled Task \u0647\u0646\u0648\u0632 Password \u0642\u062f\u06cc\u0645\u06cc \u0631\u0627 \u062f\u0627\u0631\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Failed Login\u0647\u0627\u06cc \u062a\u06a9\u0631\u0627\u0631\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
\n\n\n\n
Logon Type 5<\/h1>\n\n\n\n
Logon Type 5<\/code><\/pre>\n\n\n\n
\u0645\u0631\u0628\u0648\u0637 \u0628\u0647:<\/p>\n\n\n\n
Service<\/strong><\/p>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
\u0627\u06af\u0631 Service \u0628\u0627 Credential \u0627\u0634\u062a\u0628\u0627\u0647 Start \u0634\u0648\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Failed Login \u062a\u0648\u0644\u06cc\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
Service Account Password Changed\n            |\n            v\nService Still Uses Old Password\n            |\n            v\nRepeated 4625<\/code><\/pre>\n\n\n\n
\u0627\u06cc\u0646 \u0648\u0636\u0639\u06cc\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0638\u0627\u0647\u0631\u0627\u064b \u0634\u0628\u06cc\u0647 Brute Force \u0628\u0627\u0634\u062f\u060c \u0627\u0645\u0627 \u0645\u0646\u0628\u0639 \u0622\u0646 \u06cc\u06a9 Service \u062f\u0627\u062e\u0644\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
Logon Type 10<\/h1>\n\n\n\n
\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Logon Type\u0647\u0627 \u0628\u0631\u0627\u06cc Windows Server:<\/p>\n\n\n\n
10<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
Microsoft \u0622\u0646 \u0631\u0627:<\/p>\n\n\n\n
RemoteInteractive<\/code><\/pre>\n\n\n\n
\u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 Remote Desktop \/ Terminal Services \u0627\u0632 \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0627\u0635\u0644\u06cc \u0622\u0646 \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n
\u0627\u06af\u0631 \u0631\u0648\u06cc Server \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u06cc \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Event 4625 \u0628\u0627:<\/p>\n\n\n\n
Logon Type: 10<\/code><\/pre>\n\n\n\n
\u0648 Source IP\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f\u060c \u0628\u0627\u06cc\u062f RDP Exposure \u0648 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc Authentication \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
\n\n\n\n
Logon Type 11<\/h1>\n\n\n\n
11<\/code><\/pre>\n\n\n\n
\u0645\u0631\u0628\u0648\u0637 \u0628\u0647:<\/p>\n\n\n\n
CachedInteractive<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
\u06cc\u0639\u0646\u06cc Login \u0628\u0627 Credential\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0642\u0628\u0644\u0627\u064b \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 Cache \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u0648 \u0628\u0631\u0627\u06cc Validate \u06a9\u0631\u062f\u0646 \u0622\u0646\u0647\u0627 Domain Controller \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b Contact \u0646\u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
Failure Reason \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
Event 4625 \u062f\u0627\u0631\u0627\u06cc \u0628\u062e\u0634\u06cc \u0628\u0647 \u0646\u0627\u0645:<\/p>\n\n\n\n
Failure Information<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
\u062f\u0631 \u0622\u0646 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0645\u06cc\u200c\u0628\u06cc\u0646\u06cc\u0645:<\/p>\n\n\n\n
Failure Reason\nStatus\nSub Status<\/code><\/pre>\n\n\n\n
Status \u0648 Sub Status \u0628\u0631\u0627\u06cc \u0645\u0634\u062e\u0635 \u06a9\u0631\u062f\u0646 \u0639\u0644\u062a Authentication Failure \u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n
\n\n\n\n
Status Code\u0647\u0627\u06cc \u0645\u0647\u0645<\/h1>\n\n\n\n
\u0628\u0631\u062e\u06cc Status Code\u0647\u0627\u06cc \u0645\u0647\u0645:<\/p>\n\n\n\n
0xC0000064\nUsername does not exist<\/code><\/pre>\n\n\n\n
\u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f \u0627\u06cc\u0646 \u062e\u0637\u0627 \u0628\u0627 Username\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 Account Enumeration \u0645\u0631\u062a\u0628\u0637 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
\n\n\n\n
Password \u0627\u0634\u062a\u0628\u0627\u0647<\/h1>\n\n\n\n
0xC000006A<\/code><\/pre>\n\n\n\n
\u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647:<\/p>\n\n\n\n
Bad Password<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
Microsoft \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u06a9\u0631\u0627\u0631 \u0632\u06cc\u0627\u062f \u0627\u06cc\u0646 Error\u060c \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0628\u0631\u0627\u06cc Account\u0647\u0627\u06cc \u0645\u0647\u0645 \u06cc\u0627 Service Account\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n
\n\n\n\n
\u062e\u0637\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc Authentication<\/h1>\n\n\n\n
0xC000006D<\/code><\/pre>\n\n\n\n
\u06cc\u06a9 Generic Logon Failure \u0627\u0633\u062a \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0647 Username \u06cc\u0627 Authentication Information \u0646\u0627\u0645\u0639\u062a\u0628\u0631 \u0645\u0631\u0628\u0648\u0637 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
\n\n\n\n
Account Disabled<\/h1>\n\n\n\n
0xC0000072<\/code><\/pre>\n\n\n\n
\u06cc\u0639\u0646\u06cc \u062a\u0644\u0627\u0634 \u0628\u0631\u0627\u06cc Login \u0628\u0647 Account\u06cc \u06a9\u0647 Disabled \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
\u0627\u06af\u0631 \u0631\u0648\u06cc Account \u063a\u06cc\u0631\u0641\u0639\u0627\u0644\u06cc \u06a9\u0647 \u0646\u0628\u0627\u06cc\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u062f Failed Login \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u06cc\u062f\u060c Source \u0622\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
\n\n\n\n
Logon Type \u0645\u062c\u0627\u0632 \u0646\u06cc\u0633\u062a<\/h1>\n\n\n\n
0xC000015B<\/code><\/pre>\n\n\n\n
\u06cc\u0639\u0646\u06cc Account \u0627\u062c\u0627\u0632\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Logon Type \u0645\u0648\u0631\u062f\u0646\u0638\u0631 \u0631\u0627 \u0631\u0648\u06cc \u0627\u06cc\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0646\u062f\u0627\u0631\u062f.<\/p>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Policy \u0627\u062c\u0627\u0632\u0647 Remote Login \u0628\u0647 User \u0631\u0627 \u0646\u062f\u0627\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
\u0627\u06cc\u0646 \u0648\u0636\u0639\u06cc\u062a \u0627\u0644\u0632\u0627\u0645\u0627\u064b Attack \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
Account Expired<\/h1>\n\n\n\n
0xC0000193<\/code><\/pre>\n\n\n\n
\u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f Account \u0645\u0646\u0642\u0636\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Application \u06cc\u0627 Service \u0647\u0646\u0648\u0632 \u0628\u0627 Account \u0642\u062f\u06cc\u0645\u06cc Authentication \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f.<\/p>\n\n\n\n
\n\n\n\n
Account Locked<\/h1>\n\n\n\n
0xC0000234<\/code><\/pre>\n\n\n\n
\u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647 Lock \u0634\u062f\u0646 Account \u0627\u0633\u062a.<\/p>\n\n\n\n
\u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0628\u0627\u06cc\u062f Event:<\/p>\n\n\n\n
4740<\/code><\/pre>\n\n\n\n
\u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n
\n\n\n\n
Event ID 4740<\/h1>\n\n\n\n
Event:<\/p>\n\n\n\n
4740<\/code><\/pre>\n\n\n\n
\u0628\u0627 \u0639\u0646\u0648\u0627\u0646:<\/p>\n\n\n\n
A user account was locked out<\/code><\/pre>\n\n\n\n
\u0632\u0645\u0627\u0646\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 Account Lockout \u0631\u062e \u062f\u0647\u062f.<\/p>\n\n\n\n
\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n
Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4740\n} -MaxEvents 50<\/code><\/pre>\n\n\n\n
\n\n\n\n
Caller Computer Name \u062f\u0631 Event 4740<\/h1>\n\n\n\n
\u06cc\u06a9\u06cc \u0627\u0632 \u0641\u06cc\u0644\u062f\u0647\u0627\u06cc \u0645\u0647\u0645 4740:<\/p>\n\n\n\n
Caller Computer Name<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f \u0627\u06cc\u0646 \u0641\u06cc\u0644\u062f \u0646\u0627\u0645 \u0633\u06cc\u0633\u062a\u0645\u06cc \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 Logon Attempt \u0645\u0646\u062c\u0631 \u0628\u0647 Account Lockout \u0627\u0632 \u0622\u0646 \u062f\u0631\u06cc\u0627\u0641\u062a \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
Account Name:\nadmin\n\nCaller Computer Name:\nAPP-SERVER-02<\/code><\/pre>\n\n\n\n
\u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0645\u0634\u062e\u0635 \u06a9\u0646\u062f Password \u0642\u062f\u06cc\u0645\u06cc \u062f\u0631 \u06a9\u062f\u0627\u0645 Server \u06cc\u0627 Application \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
\n\n\n\n
\u0628\u0631\u0631\u0633\u06cc Failed Login\u0647\u0627\u06cc \u06cc\u06a9 User \u062e\u0627\u0635<\/h1>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b \u0628\u0631\u0627\u06cc:<\/p>\n\n\n\n
Administrator<\/code><\/pre>\n\n\n\n
Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n    StartTime=(Get-Date).AddDays(-1)\n} |\nWhere-Object {\n    $_.Message -match 'Administrator'\n}<\/code><\/pre>\n\n\n\n
\u0628\u0631\u0627\u06cc Investigation \u0627\u0648\u0644\u06cc\u0647 \u0645\u0646\u0627\u0633\u0628 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0686\u0648\u0646 Search \u0631\u0648\u06cc Message \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f \u062f\u0631 \u062d\u062c\u0645 \u0628\u0627\u0644\u0627 \u0631\u0648\u0634 \u0628\u0647\u06cc\u0646\u0647\u200c\u0627\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
Extract \u06a9\u0631\u062f\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Event 4625 \u0628\u0627 PowerShell<\/h1>\n\n\n\n
\u0628\u0631\u0627\u06cc \u062a\u062d\u0644\u06cc\u0644 \u062d\u0631\u0641\u0647\u200c\u0627\u06cc \u0628\u0647\u062a\u0631 \u0627\u0633\u062a XML Event \u0631\u0627 Parse \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n
$Events = Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n    StartTime=(Get-Date).AddHours(-24)\n}\n\n$Results = foreach ($Event in $Events) {\n\n    $Xml = [xml]$Event.ToXml()\n\n    $Data = @{}\n\n    foreach ($Item in $Xml.Event.EventData.Data) {\n        $Data[$Item.Name] = $Item.'#text'\n    }\n\n    [PSCustomObject]@{\n        TimeCreated     = $Event.TimeCreated\n        UserName        = $Data.TargetUserName\n        Domain          = $Data.TargetDomainName\n        LogonType       = $Data.LogonType\n        SourceIP        = $Data.IpAddress\n        SourcePort      = $Data.IpPort\n        Workstation     = $Data.WorkstationName\n        Status          = $Data.Status\n        SubStatus       = $Data.SubStatus\n        ProcessName     = $Data.ProcessName\n        AuthPackage     = $Data.AuthenticationPackageName\n    }\n}\n\n$Results<\/code><\/pre>\n\n\n\n
\u0627\u06a9\u0646\u0648\u0646 \u0628\u0647\u200c\u062c\u0627\u06cc Message \u0637\u0648\u0644\u0627\u0646\u06cc \u062e\u0631\u0648\u062c\u06cc \u0645\u0631\u062a\u0628 \u062f\u0627\u0631\u06cc\u0645.<\/p>\n\n\n\n
\n\n\n\n
\u062e\u0631\u0648\u062c\u06cc \u0631\u0627 \u0628\u0647 Table \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
$Results |\nFormat-Table `\nTimeCreated,\nUserName,\nLogonType,\nSourceIP,\nStatus `\n-AutoSize<\/code><\/pre>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
TimeCreated          UserName       LogonType SourceIP       Status\n-----------          --------       --------- --------       ------\n09\/26\/2026 02:10     Administrator  10        203.0.113.50   0xc000006a\n09\/26\/2026 02:10     Administrator  10        203.0.113.50   0xc000006a\n09\/26\/2026 02:11     admin          10        203.0.113.50   0xc0000064<\/code><\/pre>\n\n\n\n
\u0627\u06cc\u0646 \u062e\u0631\u0648\u062c\u06cc \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Pattern \u0628\u0633\u06cc\u0627\u0631 \u0645\u0646\u0627\u0633\u0628\u200c\u062a\u0631 \u0627\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
\u0628\u06cc\u0634\u062a\u0631\u06cc\u0646 Source IP\u0647\u0627 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
$Results |\nWhere-Object {\n    $_.SourceIP -and\n    $_.SourceIP -ne '-' -and\n    $_.SourceIP -ne '127.0.0.1' -and\n    $_.SourceIP -ne '::1'\n} |\nGroup-Object SourceIP |\nSort-Object Count -Descending |\nSelect-Object Count,Name<\/code><\/pre>\n\n\n\n
\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n
Count Name\n----- ----\n  842 203.0.113.50\n  216 198.51.100.22\n   14 10.10.10.25<\/code><\/pre>\n\n\n\n
\u0627\u06a9\u0646\u0648\u0646 \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u062f\u0627\u0645 IP \u0628\u06cc\u0634\u062a\u0631\u06cc\u0646 Failed Login \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
\u0628\u06cc\u0634\u062a\u0631\u06cc\u0646 Username\u0647\u0627\u06cc \u0647\u062f\u0641<\/h1>\n\n\n\n
$Results |\nGroup-Object UserName |\nSort-Object Count -Descending |\nSelect-Object Count,Name<\/code><\/pre>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
Count Name\n----- ----\n  510 Administrator\n  285 admin\n  176 support\n  122 guest<\/code><\/pre>\n\n\n\n
\u0627\u06cc\u0646 \u0627\u0644\u06af\u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u0634\u0627\u0646 \u062f\u0647\u062f \u06cc\u06a9 Source \u062f\u0631 \u062d\u0627\u0644 \u0627\u0645\u062a\u062d\u0627\u0646 \u06a9\u0631\u062f\u0646 Username\u0647\u0627\u06cc \u0645\u062a\u062f\u0627\u0648\u0644 \u0627\u0633\u062a.<\/p>\n\n\n\n
\n\n\n\n
\u062a\u0631\u06a9\u06cc\u0628 IP \u0648 Username<\/h1>\n\n\n\n
\u0628\u0631\u0627\u06cc Investigation \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u062a\u0631\u06a9\u06cc\u0628:<\/p>\n\n\n\n
Source IP\n+\nUsername<\/code><\/pre>\n\n\n\n
\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n
$Results |\nGroup-Object SourceIP,UserName |\nSort-Object Count -Descending |\nSelect-Object Count,Name<\/code><\/pre>\n\n\n\n
\u0627\u06af\u0631 \u062e\u0631\u0648\u062c\u06cc:<\/p>\n\n\n\n
900  203.0.113.50, Administrator<\/code><\/pre>\n\n\n\n
\u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06cc\u06a9 Password Guessing Pattern \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
\n\n\n\n
\u0686\u0647 Pattern\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Brute Force \u0628\u0627\u0634\u062f\u061f<\/h1>\n\n\n\n
\u0627\u0644\u06af\u0648\u06cc \u0631\u0627\u06cc\u062c:<\/p>\n\n\n\n
One Source IP\n       |\n       v\nOne Username\n       |\n       v\nHundreds of Password Attempts<\/code><\/pre>\n\n\n\n
\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
203.0.113.50\n     |\n     +-- Administrator\n     +-- Administrator\n     +-- Administrator\n     +-- Administrator<\/code><\/pre>\n\n\n\n
\u0627\u06cc\u0646 Pattern \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 Password Brute Force \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
\n\n\n\n
Password Spraying \u0686\u0647 \u0634\u06a9\u0644\u06cc \u062f\u0627\u0631\u062f\u061f<\/h1>\n\n\n\n
Pattern \u0645\u062a\u0641\u0627\u0648\u062a:<\/p>\n\n\n\n
One Source IP\n       |\n       +--> User01\n       +--> User02\n       +--> User03\n       +--> User04\n       +--> Administrator<\/code><\/pre>\n\n\n\n
\u06cc\u0639\u0646\u06cc \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Account \u0628\u0627 \u062a\u0639\u062f\u0627\u062f \u06a9\u0645\u06cc Password \u0627\u0645\u062a\u062d\u0627\u0646 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
\u0627\u06cc\u0646 \u0631\u0641\u062a\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 Password Spraying \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
\n\n\n\n
Username Enumeration<\/h1>\n\n\n\n
\u0627\u06af\u0631 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Error:<\/p>\n\n\n\n
0xC0000064<\/code><\/pre>\n\n\n\n
\u0628\u0631\u0627\u06cc Username\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Attempt \u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Username\u0647\u0627\u06cc \u0645\u0639\u062a\u0628\u0631 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
Microsoft \u0646\u06cc\u0632 \u062a\u06a9\u0631\u0627\u0631 \u0627\u06cc\u0646 Status Code \u0631\u0627 \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0627\u0644\u06af\u0648\u06cc\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 User Enumeration \u0645\u0631\u062a\u0628\u0637 \u0628\u0627\u0634\u062f \u0645\u0637\u0631\u062d \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
\n\n\n\n
\u0686\u0646\u062f IP \u0628\u0631\u0627\u06cc \u06cc\u06a9 Account<\/h1>\n\n\n\n
Pattern \u062f\u06cc\u06af\u0631:<\/p>\n\n\n\n
Administrator\n    |\n    +--> IP A\n    +--> IP B\n    +--> IP C\n    +--> IP D<\/code><\/pre>\n\n\n\n
\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n
    \n
  • Distributed Brute Force<\/li>\n\n\n\n
  • Botnet Activity<\/li>\n\n\n\n
  • \u0686\u0646\u062f Administrator \u0648\u0627\u0642\u0639\u06cc<\/li>\n\n\n\n
  • Monitoring \u06cc\u0627 Automation \u0627\u0634\u062a\u0628\u0627\u0647<\/li>\n<\/ul>\n\n\n\n
    \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    Context \u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Failed Login \u0633\u067e\u0633 Successful Login<\/h1>\n\n\n\n
    \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Correlation\u0647\u0627 \u0627\u06cc\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n
    Multiple 4625\n      |\n      v\n4624 Success<\/code><\/pre>\n\n\n\n
    Event:<\/p>\n\n\n\n
    4624<\/code><\/pre>\n\n\n\n
    \u0632\u0645\u0627\u0646\u06cc \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u06cc\u06a9 Logon Session \u0628\u0627 \u0645\u0648\u0641\u0642\u06cc\u062a \u0627\u06cc\u062c\u0627\u062f \u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645 \u0622\u06cc\u0627 \u0628\u0639\u062f \u0627\u0632 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Failed Login\u060c \u0647\u0645\u0627\u0646 Account \u0627\u0632 \u0647\u0645\u0627\u0646 Source \u0645\u0648\u0641\u0642 \u0628\u0647 Login \u0634\u062f\u0647 \u0627\u0633\u062a \u06cc\u0627 \u062e\u06cc\u0631.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc Successful Login\u0647\u0627<\/h1>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4624\n    StartTime=(Get-Date).AddHours(-24)\n}<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc RDP \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f Logon Type \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    Microsoft Logon Type 10 \u0631\u0627 RemoteInteractive<\/code> \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Pattern \u0627\u0645\u0646\u06cc\u062a\u06cc<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
    02:10  4625  Administrator  203.0.113.50\n02:10  4625  Administrator  203.0.113.50\n02:10  4625  Administrator  203.0.113.50\n02:11  4625  Administrator  203.0.113.50\n02:12  4624  Administrator  203.0.113.50<\/code><\/pre>\n\n\n\n
    \u0627\u06cc\u0646 Pattern \u0628\u0627\u06cc\u062f \u062c\u062f\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0627\u0645\u0627 \u062d\u062a\u06cc \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0646\u06cc\u0632 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a Compromise \u0646\u06cc\u0633\u062a\u061b \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Administrator \u0648\u0627\u0642\u0639\u06cc \u0686\u0646\u062f \u0628\u0627\u0631 Password \u0631\u0627 \u0627\u0634\u062a\u0628\u0627\u0647 \u0648\u0627\u0631\u062f \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0639\u062f \u0627\u0632 Successful Login \u0686\u0647 \u0686\u06cc\u0632\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Login \u0645\u0634\u06a9\u0648\u06a9 \u0645\u0648\u0641\u0642 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c Timeline \u0628\u0639\u062f \u0627\u0632 Event 4624 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0647\u200c\u062e\u0635\u0648\u0635:<\/p>\n\n\n\n
    4672\n4688\n4697\n4698\n4720\n4732<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
    4672 = Special Privileges Assigned\n4688 = Process Created\n4697 = Service Installed\n4698 = Scheduled Task Created\n4720 = User Created\n4732 = Member Added to Local Group<\/code><\/pre>\n\n\n\n
    \u0627\u06cc\u0646 Event\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0645\u0634\u062e\u0635 \u06a9\u0646\u0646\u062f \u0628\u0639\u062f \u0627\u0632 Login \u0686\u0647 \u0627\u062a\u0641\u0627\u0642\u06cc \u0627\u0641\u062a\u0627\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc Event 4672<\/h1>\n\n\n\n
    Account\u0647\u0627\u06cc Administrator \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Event:<\/p>\n\n\n\n
    4672<\/code><\/pre>\n\n\n\n
    \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n
    Microsoft \u0627\u06cc\u0646 Event \u0631\u0627 \u0628\u0631\u0627\u06cc Assignment \u0634\u062f\u0646 Privilege\u0647\u0627\u06cc \u0648\u06cc\u0698\u0647 \u0628\u0647 \u06cc\u06a9 Logon Session \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \u0627\u06af\u0631 Login \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0627 4624 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u060c Event\u0647\u0627\u06cc 4672 \u0646\u0632\u062f\u06cc\u06a9 \u0647\u0645\u0627\u0646 \u0632\u0645\u0627\u0646 \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Event ID 4776 \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Authentication \u0627\u0632 NTLM \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f\u060c Event:<\/p>\n\n\n\n
    4776<\/code><\/pre>\n\n\n\n
    \u0628\u0633\u06cc\u0627\u0631 \u0645\u0641\u06cc\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n
    Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f \u0627\u06cc\u0646 Event \u0647\u0646\u06af\u0627\u0645 Credential Validation \u0628\u0627 NTLM \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f. \u0628\u0631\u0627\u06cc Domain Account\u060c Domain Controller \u0645\u0631\u062c\u0639 Credential \u0627\u0633\u062a\u061b \u0628\u0631\u0627\u06cc Local Account\u060c \u062e\u0648\u062f Computer \u0645\u0631\u062c\u0639 \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u0634\u0627\u0647\u062f\u0647 Event 4776<\/h1>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4776\n} -MaxEvents 100<\/code><\/pre>\n\n\n\n
    \u0641\u06cc\u0644\u062f\u0647\u0627\u06cc \u0645\u0647\u0645:<\/p>\n\n\n\n
    Logon Account\nSource Workstation\nError Code<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u062d\u062f\u0648\u062f\u06cc\u062a \u0645\u0647\u0645 4776<\/h1>\n\n\n\n
    Event 4776 \u0645\u0639\u0645\u0648\u0644\u0627\u064b:<\/p>\n\n\n\n
    Source Workstation<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f\u060c \u0646\u0647 \u0644\u0632\u0648\u0645\u0627\u064b Source IP.<\/p>\n\n\n\n
    Microsoft \u0646\u06cc\u0632 \u062a\u0623\u06a9\u06cc\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f \u0627\u06cc\u0646 Event \u0628\u0631\u0627\u06cc NTLM \u0645\u0646\u0628\u0639 Authentication \u0631\u0627 \u0628\u0627 Computer Name \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 Destination Computer \u0631\u0627 \u062f\u0631 Event \u0627\u0631\u0627\u0626\u0647 \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0628\u0631\u0627\u06cc Source IP \u0645\u0639\u0645\u0648\u0644\u0627\u064b Event 4625 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0633\u062a\u0642\u06cc\u0645\u200c\u062a\u0631\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Failed Login \u0627\u0632 Service Account<\/h1>\n\n\n\n
    \u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    UserName:\nSQLService\n\nSource IP:\n10.10.10.25\n\nLogon Type:\n5<\/code><\/pre>\n\n\n\n
    \u0647\u0631 \u0686\u0646\u062f \u062f\u0642\u06cc\u0642\u0647 \u062a\u06a9\u0631\u0627\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0627\u06cc\u0646 Pattern \u0628\u06cc\u0634\u062a\u0631 \u0628\u0647:<\/p>\n\n\n\n
    Service using old credentials<\/code><\/pre>\n\n\n\n
    \u0634\u0628\u06cc\u0647 \u0627\u0633\u062a \u062a\u0627 \u06cc\u06a9 Brute Force \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u06cc.<\/p>\n\n\n\n
    \u062f\u0631 \u0686\u0646\u06cc\u0646 \u0634\u0631\u0627\u06cc\u0637\u06cc Service\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645:<\/p>\n\n\n\n
    Get-CimInstance Win32_Service |\nWhere-Object {\n    $_.StartName -match 'SQLService'\n} |\nSelect-Object Name,State,StartName,PathName<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Scheduled Task \u0628\u0627 Password \u0642\u062f\u06cc\u0645\u06cc<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Logon Type:<\/p>\n\n\n\n
    4<\/code><\/pre>\n\n\n\n
    \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c Scheduled Task\u0647\u0627 \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    Get-ScheduledTask |\nWhere-Object {\n    $_.Principal.UserId -match 'UserName'\n} |\nSelect-Object TaskName,TaskPath,State<\/code><\/pre>\n\n\n\n
    Password \u0642\u062f\u06cc\u0645\u06cc \u062f\u0631 Task \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Failed Login\u0647\u0627\u06cc \u0645\u062f\u0627\u0648\u0645 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    RDP Failed Login\u0647\u0627<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Server \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b RDP \u0631\u0627 \u0627\u0632 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u062f\u0631\u06cc\u0627\u0641\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c Event\u0647\u0627\u06cc:<\/p>\n\n\n\n
    4625<\/code><\/pre>\n\n\n\n
    \u0628\u0627:<\/p>\n\n\n\n
    Logon Type 10<\/code><\/pre>\n\n\n\n
    \u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n
    \u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
    Account Name:\nAdministrator\n\nLogon Type:\n10\n\nSource Network Address:\n203.0.113.50<\/code><\/pre>\n\n\n\n
    \u0627\u06cc\u0646 Pattern \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647 \u062a\u0644\u0627\u0634 Remote Authentication \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    RDP Session\u0647\u0627\u06cc \u0641\u0639\u0644\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
    quser<\/code><\/pre>\n\n\n\n
    \u06cc\u0627:<\/p>\n\n\n\n
    query user<\/code><\/pre>\n\n\n\n
    \u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
    USERNAME        SESSIONNAME    ID   STATE\nAdministrator   rdp-tcp#4      2    Active<\/code><\/pre>\n\n\n\n
    \u0627\u06af\u0631 \u0628\u0639\u062f \u0627\u0632 Login \u0645\u0634\u06a9\u0648\u06a9 Session \u0641\u0639\u0627\u0644 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u060c Investigation \u0628\u0627\u06cc\u062f \u0627\u062f\u0627\u0645\u0647 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Failed Login \u0627\u0632 Localhost<\/h1>\n\n\n\n
    \u0627\u06af\u0631:<\/p>\n\n\n\n
    Source Network Address:\n127.0.0.1<\/code><\/pre>\n\n\n\n
    \u06cc\u0627:<\/p>\n\n\n\n
    ::1<\/code><\/pre>\n\n\n\n
    \u0627\u0633\u062a\u060c \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0627\u0632 Local System \u0622\u0645\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
    \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0628\u06cc\u0634\u062a\u0631 \u0628\u0627\u06cc\u062f \u062f\u0646\u0628\u0627\u0644 \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n
    Service\nScheduled Task\nApplication\nScript\nLocal Process<\/code><\/pre>\n\n\n\n
    \u0628\u0627\u0634\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Caller Process \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
    \u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f Event 4625 \u0646\u0634\u0627\u0646 \u062f\u0647\u062f:<\/p>\n\n\n\n
    Caller Process ID:\n0x1f40<\/code><\/pre>\n\n\n\n
    \u0627\u0628\u062a\u062f\u0627 \u0645\u0642\u062f\u0627\u0631 Hex \u0631\u0627 \u0628\u0647 Decimal \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    [Convert]::ToInt32(\"1f40\",16)<\/code><\/pre>\n\n\n\n
    \u0633\u067e\u0633 Process \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Get-Process -Id 8000<\/code><\/pre>\n\n\n\n
    \u0627\u0644\u0628\u062a\u0647 Process \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u06cc\u06af\u0631 \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0646\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a Event:<\/p>\n\n\n\n
    4688<\/code><\/pre>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc Correlation Process Creation \u0645\u0641\u06cc\u062f \u0628\u0627\u0634\u062f. Microsoft \u0646\u06cc\u0632 \u0647\u0645\u06cc\u0646 Correlation \u0631\u0627 \u0628\u0631\u0627\u06cc Process ID \u062f\u0631 Event 4625 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Authentication Package \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
    \u0641\u06cc\u0644\u062f:<\/p>\n\n\n\n
    Authentication Package<\/code><\/pre>\n\n\n\n
    \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0642\u0627\u062f\u06cc\u0631\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n
    NTLM\nKerberos\nNegotiate<\/code><\/pre>\n\n\n\n
    \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    Negotiate<\/code> \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u06cc\u0646 Kerberos \u0648 NTLM \u0627\u0646\u062a\u062e\u0627\u0628 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \u062f\u0631 Domain Environment \u0646\u0648\u0639 Authentication \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc Troubleshooting \u0648 Security Investigation \u0645\u0641\u06cc\u062f \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Audit Policy \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Event\u0647\u0627\u06cc Failed Login \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u0646\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Audit Policy \u0645\u0646\u0627\u0633\u0628 \u0641\u0639\u0627\u0644 \u0646\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    auditpol \/get \/subcategory:\"Logon\"<\/code><\/pre>\n\n\n\n
    \u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n
    auditpol \/get \/subcategory:\"Credential Validation\"<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u0645\u0627\u0645 Policy\u0647\u0627:<\/p>\n\n\n\n
    auditpol \/get \/category:*<\/code><\/pre>\n\n\n\n
    Microsoft \u062a\u0646\u0638\u06cc\u0645\u0627\u062a Advanced Audit Policy \u0631\u0627 \u062f\u0631 \u0645\u0633\u06cc\u0631:<\/p>\n\n\n\n
    Computer Configuration\n  \u2192 Windows Settings\n    \u2192 Security Settings\n      \u2192 Advanced Audit Policy Configuration<\/code><\/pre>\n\n\n\n
    \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u062e\u0634 Logon\/Logoff \u0628\u0631\u0627\u06cc Success \u0648 Failure Login\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0641\u0639\u0627\u0644 \u0628\u0648\u062f\u0646 Failure Auditing \u0645\u0647\u0645 \u0627\u0633\u062a<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u062a\u062d\u0644\u06cc\u0644 Failed Login \u0628\u0627\u06cc\u062f Audit Logon \u0628\u0647 \u0634\u06a9\u0644\u06cc \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f \u06a9\u0647:<\/p>\n\n\n\n
    Failure<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u062f.<\/p>\n\n\n\n
    \u062f\u0631 \u0645\u062d\u06cc\u0637 Domain \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0627\u0632 Group Policy \u0645\u062f\u06cc\u0631\u06cc\u062a \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \u0642\u0628\u0644 \u0627\u0632 \u062a\u063a\u06cc\u06cc\u0631 Audit Policy \u062f\u0631 Production \u0627\u062b\u0631 \u0622\u0646 \u0628\u0631 \u062d\u062c\u0645 Log\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u06cc\u0634\u062a\u0631\u06cc\u0646 Failed Login \u062f\u0631 \u0647\u0631 \u0633\u0627\u0639\u062a<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Spike:<\/p>\n\n\n\n
    $Results |\nGroup-Object {\n    $_.TimeCreated.ToString(\"yyyy-MM-dd HH\")\n} |\nSort-Object Name |\nSelect-Object Name,Count<\/code><\/pre>\n\n\n\n
    \u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n
    2026-09-26 01    12\n2026-09-26 02   948\n2026-09-26 03    21<\/code><\/pre>\n\n\n\n
    \u06cc\u06a9 \u0627\u0641\u0632\u0627\u06cc\u0634 \u0646\u0627\u06af\u0647\u0627\u0646\u06cc \u062f\u0631 \u0633\u0627\u0639\u062a 02 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u0642\u0637\u0647 \u0634\u0631\u0648\u0639 Investigation \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Failed Login \u0641\u0642\u0637 \u0628\u0627 Logon Type 10<\/h1>\n\n\n\n
    $Results |\nWhere-Object {\n    $_.LogonType -eq '10'\n}<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u06af\u0631\u0648\u0647\u200c\u0628\u0646\u062f\u06cc Source IP\u0647\u0627:<\/p>\n\n\n\n
    $Results |\nWhere-Object {\n    $_.LogonType -eq '10'\n} |\nGroup-Object SourceIP |\nSort-Object Count -Descending |\nSelect-Object Count,Name<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0641\u0642\u0637 Bad Password\u0647\u0627<\/h1>\n\n\n\n
    $Results |\nWhere-Object {\n    $_.Status -eq '0xc000006a' -or\n    $_.SubStatus -eq '0xc000006a'\n}<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    Username\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u062c\u0648\u062f<\/h1>\n\n\n\n
    $Results |\nWhere-Object {\n    $_.Status -eq '0xc0000064' -or\n    $_.SubStatus -eq '0xc0000064'\n}<\/code><\/pre>\n\n\n\n
    \u0627\u06af\u0631 Username\u0647\u0627\u06cc \u0645\u062a\u0646\u0648\u0639 \u0632\u06cc\u0627\u062f\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c \u0627\u062d\u062a\u0645\u0627\u0644 Account Enumeration \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u062e\u0631\u0648\u062c\u06cc Failed Login \u0631\u0627 Export \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc Incident Response:<\/p>\n\n\n\n
    $Results |\nExport-Csv `\nC:\\IR\\failed-logins.csv `\n-NoTypeInformation<\/code><\/pre>\n\n\n\n
    \u0627\u06a9\u0646\u0648\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062f\u0627\u062f\u0647 \u0631\u0627 \u062f\u0631 Excel\u060c SIEM \u06cc\u0627 \u0627\u0628\u0632\u0627\u0631 \u062a\u062d\u0644\u06cc\u0644\u06cc \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Security Log \u0631\u0627 Export \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u062d\u0641\u0638 Evidence \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Security Log \u0631\u0627 \u0646\u06cc\u0632 Export \u06a9\u0631\u062f.<\/p>\n\n\n\n
    \u0645\u062b\u0644\u0627\u064b \u0628\u0627 wevtutil<\/code>:<\/p>\n\n\n\n
    wevtutil epl Security C:\\IR\\Security.evtx<\/code><\/pre>\n\n\n\n
    \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Evidence \u0642\u0628\u0644 \u0627\u0632 \u067e\u0627\u06a9\u200c\u0633\u0627\u0632\u06cc \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u062d\u0641\u0638 \u0634\u0648\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u06cc\u06a9 Workflow \u0639\u0645\u0644\u06cc \u0628\u0631\u0627\u06cc \u062a\u062d\u0644\u06cc\u0644 Failed Login<\/h1>\n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: Event\u0647\u0627\u06cc 24 \u0633\u0627\u0639\u062a \u0627\u062e\u06cc\u0631<\/h2>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n    StartTime=(Get-Date).AddHours(-24)\n}<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0645: \u0627\u0633\u062a\u062e\u0631\u0627\u062c Username \u0648 IP<\/h2>\n\n\n\n
    \u0627\u0632 Script XML Parsing \u0628\u062e\u0634 \u0642\u0628\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f \u0648 $Results<\/code> \u0628\u0633\u0627\u0632\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u0633\u0648\u0645: Top IP\u0647\u0627<\/h2>\n\n\n\n
    $Results |\nGroup-Object SourceIP |\nSort-Object Count -Descending |\nSelect Count,Name<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u0686\u0647\u0627\u0631\u0645: Top Username\u0647\u0627<\/h2>\n\n\n\n
    $Results |\nGroup-Object UserName |\nSort-Object Count -Descending |\nSelect Count,Name<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u067e\u0646\u062c\u0645: Logon Type<\/h2>\n\n\n\n
    $Results |\nGroup-Object LogonType |\nSort-Object Count -Descending |\nSelect Count,Name<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u0634\u0634\u0645: Failure Status<\/h2>\n\n\n\n
    $Results |\nGroup-Object Status |\nSort-Object Count -Descending |\nSelect Count,Name<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u0647\u0641\u062a\u0645: Account Lockout<\/h2>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4740\n    StartTime=(Get-Date).AddHours(-24)\n}<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u0647\u0634\u062a\u0645: Successful Login<\/h2>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4624\n    StartTime=(Get-Date).AddHours(-24)\n}<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u0646\u0647\u0645: NTLM Validation<\/h2>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4776\n    StartTime=(Get-Date).AddHours(-24)\n}<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062d\u0644\u0647 \u062f\u0647\u0645: \u0628\u0631\u0631\u0633\u06cc Timeline \u0628\u0639\u062f \u0627\u0632 Login \u0645\u0648\u0641\u0642<\/h2>\n\n\n\n
    Event\u0647\u0627\u06cc:<\/p>\n\n\n\n
    4672\n4688\n4697\n4698\n4720\n4732<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u062f\u0631 \u0647\u0645\u0627\u0646 \u0628\u0627\u0632\u0647 \u0632\u0645\u0627\u0646\u06cc \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u06cc\u06a9 Audit \u0633\u0631\u06cc\u0639<\/h1>\n\n\n\n
    Write-Host \"`n=== FAILED LOGINS ===\"\n\nGet-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4625\n    StartTime=(Get-Date).AddHours(-24)\n} -ErrorAction SilentlyContinue |\nSelect-Object TimeCreated,Id,Message\n\n\nWrite-Host \"`n=== ACCOUNT LOCKOUTS ===\"\n\nGet-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4740\n    StartTime=(Get-Date).AddHours(-24)\n} -ErrorAction SilentlyContinue |\nSelect-Object TimeCreated,Id,Message\n\n\nWrite-Host \"`n=== SUCCESSFUL LOGINS ===\"\n\nGet-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4624\n    StartTime=(Get-Date).AddHours(-24)\n} -ErrorAction SilentlyContinue |\nSelect-Object TimeCreated,Id,Message<\/code><\/pre>\n\n\n\n
    \u0627\u06cc\u0646 Command\u0647\u0627 \u062a\u063a\u06cc\u06cc\u0631\u06cc \u0631\u0648\u06cc Server \u0627\u06cc\u062c\u0627\u062f \u0646\u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0686\u0647 Pattern\u0647\u0627\u06cc\u06cc \u0645\u0647\u0645\u200c\u062a\u0631 \u0647\u0633\u062a\u0646\u062f\u061f<\/h1>\n\n\n\n
    \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Failed Login \u0628\u0631\u0627\u06cc \u06cc\u06a9 Account<\/h3>\n\n\n\n
    One IP\n+\nOne Account\n+\nHundreds of Failures<\/code><\/pre>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 Brute Force \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Username \u0627\u0632 \u06cc\u06a9 Source<\/h1>\n\n\n\n
    One IP\n+\nMany Usernames<\/code><\/pre>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627:<\/p>\n\n\n\n
    Username Enumeration\nPassword Spraying<\/code><\/pre>\n\n\n\n
    \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Account Lockout\u0647\u0627\u06cc \u0645\u062f\u0627\u0648\u0645<\/h1>\n\n\n\n
    4625\n+\n4740\n+\nSame Account<\/code><\/pre>\n\n\n\n
    \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0646\u0627\u0634\u06cc \u0627\u0632:<\/p>\n\n\n\n
    Attack\nOld Service Password\nScheduled Task\nMobile Device\nMapped Drive\nApplication<\/code><\/pre>\n\n\n\n
    \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 Caller Computer \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Failed Login \u0648 \u0633\u067e\u0633 Success<\/h1>\n\n\n\n
    4625\n4625\n4625\n4624<\/code><\/pre>\n\n\n\n
    \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0627\u06af\u0631:<\/p>\n\n\n\n
    Same Account\nSame Source\nShort Time Window<\/code><\/pre>\n\n\n\n
    \u0628\u0627\u0634\u062f\u060c \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0641\u0648\u0631\u06cc\u200c\u062a\u0631 \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    Failed Login \u0631\u0648\u06cc Account \u063a\u06cc\u0631\u0641\u0639\u0627\u0644<\/h1>\n\n\n\n
    \u0627\u06af\u0631:<\/p>\n\n\n\n
    Status = 0xC0000072<\/code><\/pre>\n\n\n\n
    \u0648 Account \u0645\u062f\u062a\u200c\u0647\u0627\u0633\u062a Disabled \u0627\u0633\u062a\u060c \u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u0686\u0647 \u0633\u06cc\u0633\u062a\u0645 \u06cc\u0627 \u0634\u062e\u0635\u06cc \u0647\u0646\u0648\u0632 \u062a\u0644\u0627\u0634 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0627\u0632 \u0622\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0686\u0647 \u0686\u06cc\u0632\u0647\u0627\u06cc\u06cc False Positive \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u061f<\/h1>\n\n\n\n
    Failed Login \u0647\u0645\u06cc\u0634\u0647 Attack \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n
    \u0645\u0648\u0627\u0631\u062f \u0631\u0627\u06cc\u062c:<\/p>\n\n\n\n
    User typed wrong password\nService password changed\nScheduled Task uses old password\nMapped Drive\nOld RDP Credential\nApplication Pool\nSQL Service\nBackup Software\nMonitoring Agent\nExpired Account\nDisconnected Domain Controller<\/code><\/pre>\n\n\n\n
    \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0641\u0642\u0637 Count Event\u0647\u0627 \u0645\u0639\u06cc\u0627\u0631 \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    Source IP \u062e\u0635\u0648\u0635\u06cc \u0631\u0627 \u062c\u062f\u06cc \u0628\u06af\u06cc\u0631\u06cc\u0645\u061f<\/h1>\n\n\n\n
    \u0628\u0644\u0647.<\/p>\n\n\n\n
    \u0627\u06af\u0631 Source IP:<\/p>\n\n\n\n
    10.x.x.x\n172.16.x.x\n192.168.x.x<\/code><\/pre>\n\n\n\n
    \u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Activity \u0627\u0632 \u062f\u0627\u062e\u0644 Network \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a Source System \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Credential \u0642\u062f\u06cc\u0645\u06cc \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f \u06cc\u0627 \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u062f\u0627\u062e\u0644\u06cc Compromise \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Source IP \u062e\u0627\u0631\u062c\u06cc<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Windows Server \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b \u0631\u0648\u06cc \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f \u0648 Failed Login \u0627\u0632 IP\u0647\u0627\u06cc Public \u062f\u0631\u06cc\u0627\u0641\u062a \u0645\u06cc\u200c\u0634\u0648\u062f\u060c Exposure \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f RDP \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Remote Administrative Access \u0627\u0632 \u0637\u0631\u06cc\u0642:<\/p>\n\n\n\n
    VPN\nZero Trust Access\nBastion \/ Jump Server\nRestricted Firewall Rules<\/code><\/pre>\n\n\n\n
    \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0622\u06cc\u0627 \u0641\u0642\u0637 Block \u06a9\u0631\u062f\u0646 IP \u06a9\u0627\u0641\u06cc \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n
    \u062e\u06cc\u0631.<\/p>\n\n\n\n
    IP \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0646\u062f \u06cc\u0627 \u062d\u0645\u0644\u0647 Distributed \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0627\u0635\u0644\u06cc \u0628\u0627\u06cc\u062f \u0634\u0627\u0645\u0644 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0628\u0627\u0634\u0646\u062f:<\/p>\n\n\n\n
    Reduce exposed services\nMFA\nStrong authentication\nAccount Lockout Policy\nRestricted RDP\nVPN \/ Bastion\nMonitoring\nEDR \/ SIEM<\/code><\/pre>\n\n\n\n
    Block \u06a9\u0631\u062f\u0646 IP \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u062a\u06a9\u0645\u06cc\u0644\u06cc \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Account Administrator \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n
    Account\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n
    Administrator\nDomain Admin\nBackup Admin\nService Accounts<\/code><\/pre>\n\n\n\n
    \u0627\u0631\u0632\u0634 \u0628\u06cc\u0634\u062a\u0631\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n
    Microsoft \u0646\u06cc\u0632 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f Failed Authentication \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Account\u0647\u0627\u06cc \u0628\u0627\u0627\u0631\u0632\u0634 \u0648 Service Account\u0647\u0627 \u062f\u0642\u06cc\u0642\u200c\u062a\u0631 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u0634\u0648\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Log\u0647\u0627 \u0631\u0627 \u0645\u0631\u06a9\u0632\u06cc \u0646\u06af\u0647 \u062f\u0627\u0631\u06cc\u062f<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Security Log \u0641\u0642\u0637 \u0631\u0648\u06cc \u0647\u0645\u0627\u0646 Server \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u0634\u0648\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u062f\u0627\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc Administrator \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Log \u0631\u0627 \u067e\u0627\u06a9 \u06a9\u0646\u062f \u06cc\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u06a9\u0646\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc Server\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Event\u0647\u0627 \u0628\u0647:<\/p>\n\n\n\n
    SIEM\nWindows Event Collector\nEDR\nCentral Log Server<\/code><\/pre>\n\n\n\n
    \u0627\u0631\u0633\u0627\u0644 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n
    \u0628\u0631\u062e\u06cc \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c \u0647\u0646\u06af\u0627\u0645 \u062a\u062d\u0644\u06cc\u0644 Failed Login \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n