In this simulation, you will analyze a sequence of Active Directory security events to identify automated domain responses to credential abuse. You'll learn how to distinguish between administrative account actions and threshold-based log patterns, a critical skill for L1/L2 SOC triage.
Scenario Context
You are a Tier 3 SOC Analyst at a mid-sized healthcare provider. An L1 analyst has escalated a ticket regarding an IT administrator's service account (svc_backup_admin) failing to authenticate to multiple critical file shares.
The L1 analyst suspects an active brute-force attack or ransomware propagation. You pull the Windows Event Logs from the primary Domain Controller (DC-01) for the last 15 minutes to establish a timeline of events surrounding the account.
Security Environment
Your SIEM query returns the following chronological log sequence from the Windows Security event channel:
Time: 09:14:22 | EventID:4625 | Account: svc_backup_admin | Reason: Unknown user name or bad password.
Time: 09:14:23 | EventID:4625 | Account: svc_backup_admin | Reason: Unknown user name or bad password.
Time: 09:14:25 | EventID:4625 | Account: svc_backup_admin | Reason: Unknown user name or bad password.
Time: 09:14:25 | EventID:4740 | TargetAccount: svc_backup_admin | CallerComputerName: APP-SVR-02
Time: 09:15:01 | EventID:4625 | Account: svc_backup_admin | Reason: Account currently disabled or locked out.
Question
What does Windows event ID 4740 indicate?
SOC Hint: Look at the timeline in the Security Environment. Three bad passwords occurred in 3 seconds, followed immediately by this event. What automatic defensive action does Active Directory take when a password threshold is crossed?
Expert Insight
1. What is Happening
The timeline shows a service account experiencing rapid consecutive failed logons (Event ID 4625). Because the Domain Controller's Account Lockout Policy threshold was met (likely set to 3 or 5 invalid attempts), Active Directory automatically stepped in to protect the account by generating Event ID 4740.
2. Why the Correct Answer is Correct
A is correct. In Windows Security Auditing, Event ID 4740 definitively means "A user account was locked out." This is an automated system response, not a manual administrative action. It occurs on Domain Controllers when the `badPwdCount` attribute hits the configured domain threshold.
3. Why Other Options are Wrong
Memorizing the core AD account lifecycle events is essential for creating SIEM detection logic:
B (Account disabled): This is Event ID 4725. Disabling is usually a deliberate administrative action (e.g., an employee is terminated), whereas a lockout is a temporary, automated security response.
C (Account enabled): This is Event ID 4722. You will see this when an administrator provisions a new account or intentionally re-enables a disabled one.
D (Account created): This is Event ID 4720. This is a highly monitored event in SOCs to detect rogue administrators or unauthorized privilege escalation (e.g., creating shadow accounts).
4. Real-World SOC Application
When an L1 analyst sees a 4740, the immediate question shouldn't just be "Who got locked out?", but rather "Where did the bad logins come from?". By looking at the CallerComputerName field within the 4740 log (or correlating the preceding 4625 logs), you can pivot your investigation to the source machine. In our scenario, the source is APP-SVR-02. This usually indicates a stale cached credential, a mapped drive with an old password, or a scheduled task failing to authenticate, rather than an external attacker.
MINI LESSON: The Account Lockout Investigation Pattern
When triaging account lockouts, follow this standard workflow to avoid false positives and quickly identify root causes:
Identify the trigger: Query for Event ID 4740. Extract the TargetAccount and CallerComputerName.
Trace the source: If the CallerComputerName is internal, pivot your SIEM search to that specific host. If it's a perimeter device (like a VPN appliance or Exchange server), suspect password spraying.
Analyze the failed logons: Query Event ID 4625 on the source host just prior to the lockout time. Look at the Logon Type field (e.g., Type 3 is Network, Type 2 is Interactive, Type 7 is Unlock) to determine *how* the authentication was attempted.
Determine intent: A single account locked out via an internal server is usually IT misconfiguration (stale creds). Multiple different accounts locked out from a public-facing IP is an active attack requiring immediate IP blocking.
Sharpen your SIEM analysis and prepare for the CSA exam.