Windows Security 4776 — NTLM credential validation
Windows Security 4776 — NTLM credential validation. The authoritative computer attempted to validate credentials with NTLM.
Source and collection
Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.
Configure Audit Credential Validation. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.
Native example and provenance
publisher documentation example. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — preformatted example 1
Removed Event Viewer tree expansion markers before XML tags; field values unchanged.
Download the exact sample · Offline research kit
SHA-256: 9480a9ba4a83195198184e4085596973c6eacf3b5ba5be78b4b35932e5c26fd1
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4776</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14336</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2015-07-25T04:38:11.003163100Z" />
<EventRecordID>165437</EventRecordID>
<Correlation />
<Execution ProcessID="500" ThreadID="532" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
<EventData>
<Data Name="PackageName">MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0</Data>
<Data Name="TargetUserName">dadmin</Data>
<Data Name="Workstation">WIN81</Data>
<Data Name="Status">0xc0000234</Data>
</EventData>
</Event>
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
Microsoft-Windows-Security-Auditing | XML text |
EventID | XML text |
Version | XML text |
Level | XML text |
Task | XML text |
Opcode | XML text |
Keywords | XML text |
TimeCreated | XML text |
EventRecordID | XML text |
Correlation | XML text |
Execution | XML text |
Channel | XML text |
Computer | XML text |
Security | XML text |
PackageName | XML text |
TargetUserName | XML text |
Workstation | XML text |
Status | XML text |
- System/EventID
- Event identifier within the named provider.
- System/Version
- Version of this event layout.
- System/TimeCreated/@SystemTime
- Event timestamp in UTC.
- EventData
- Named fields; use names, not positional array indices.
- Relevant fields
- TargetUserName, Workstation, Status
Investigation uses
- Correlate workstation, account and status with destination logon events.
- Compare event time with ingestion time and retain the original XML for a reviewable evidence trail.
Validation boundaries
This event does not supply the complete destination connection; success status alone does not show what the user accessed. This sample uses event version 0.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.