We have recently identified numerous login attempts from an internal machine to the active directory domain controller. The attempts are directed at the domain administrator account.
As an initial response, we checked to see whether there was some malware on the host machine that was initiating these attempts, but a scan from our AV did not return any results. Soon after this we checked the list of programs installed on the machine and everything was as per standard rollout on a user machine. Also to verify whether or not there was an automated tool, I changed the IP of the machine an re-connected it to the network by logging in to the domain and logging out of the domain, keeping it connected to the network. In both instances, the only traffic observed was a single IPC$ connection to the Active Directory DC. There were no login attempts.
How can I detect what caused the multiple login attempts?