Authentication Failure Against Non-Existent Account - Username Enumeration

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects high volumes of authentication failures (EventID 4625) using sub-status 0xC0000064, which indicates the attempted username does not exist. A high frequency of these events targeting multiple non-existent accounts is a strong indicator of automated username enumeration or credential stuffing.