← Windows Sign-In Evidence: Investigating Authentication Across Hosts
1. Build the Sign-In Evidence Model
From Credentials to a Windows Logon Session Place Events on the Computer That Knows the Fact
2. Interpret Kerberos and NTLM Evidence
Reconstruct Kerberos Ticket Activity Interpret NTLM Validation and Fallback
3. Investigate and Make the Decision
Build a Cross-Host Authentication Timeline Baseline, Escalate, and Document the Finding
3. Investigate and Make the Decision

Baseline, Escalate, and Document the Finding

Measure deviations against peer and historical behavior, assess impact separately, and write a sign-in disposition that another analyst can reproduce.

In this lesson, you will learn to:

  • Design a contextual sign-in baseline that accounts for account and device roles.
  • Write an evidence-linked disposition and escalate according to impact and authority.

Baseline, Escalate, and Document the Finding

Closes the course with practical baseline design, alert logic, false-positive control, severity, containment authority, and handoff quality.

Use role-aware baselines instead of universal thresholds

A useful baseline preserves context: human user, service account, computer account, administrator, workstation, server, domain controller, application, protocol, logon type, time window, and target class. Compare an entity with its own history and a relevant peer group. A global threshold for failed logons mixes user typing errors, service retries, Internet-facing attacks, and scheduled jobs. Track rates, distinct accounts, distinct sources, success-after-failure, new source-target pairs, protocol changes, and sensitive-target access.

Baselines change during password rotations, deployments, remote-work shifts, acquisitions, and incident response. Record the comparison period and suppress only explained behavior with an owner and expiry. A rule that excludes every service account hides compromised services; a rule that alerts on every type 3 logon overwhelms analysts. Prefer analytic combinations that express a scenario and required telemetry. Test them on known normal periods and incident examples, then monitor missing-data rates as part of detection health.

Role-aware baselines reveal meaningful deviationsHuman users, services, administrators, and computer accounts have different frequencies, protocols, sources, and targets.FIELD GUIDERole-aware baselines reveal meaningful deviationsHuman userService accountAdministratorComputer accountBASELINE PLOT
Role-aware baselines reveal meaningful deviations — Human users, services, administrators, and computer accounts have different frequencies, protocols, sources, and targets.

Make severity and confidence explicit

Separate confidence from impact. Confidence describes how strongly evidence supports unauthorized activity. Impact describes the affected privilege, resource, data, and persistence. A low-confidence event involving a domain administrator on a critical controller may justify rapid validation, while a high-confidence failed attempt against a disabled test account may not require containment. Follow the response plan for account disablement, session revocation, device isolation, or password reset; these actions can disrupt services and destroy useful access context.

The case note should identify the anchor event, scope, normalized timeline, raw-event locations, expected baseline, deviations, alternative explanation tested, affected assets, and actions taken. State collection gaps and confidence. Include precise language: “4776 recorded successful NTLM validation for account X on DC Y; target server remains unconfirmed” is stronger than “NTLM login to server Z” when the destination was inferred. Feed confirmed benign causes back into configuration or expiring detection logic, and confirmed malicious behavior into broader scoping and durable detection.

Sign-in decisions separate confidence from impactEvidence strength and business or privilege impact combine with authority to determine validation, escalation, or containment.FIELD GUIDESign-in decisions separate confidence from impactIMPACTCONFIDENCE / FREQUENCYMonitor and enrichValidate urgentlyClose with evidenceContain and escalateRISK MATRIX
Sign-in decisions separate confidence from impact — Evidence strength and business or privilege impact combine with authority to determine validation, escalation, or containment.

Resources

← Previous: Build a Cross-Host Authentication Timeline