Knowledge Base
Timelines
Брутфорс доменных учетныз записей по протоколу SMB
Scanning via the SMB protocol from the attacker's non-domain workstation (192.168.0.234) to the domain workstation ws2025.socpedia.net.
Kerberos authorization
From workstation ws2025.socpedia.net we connect via RDP to sp.socpedia.net using the domain account lacaladmin with an incorrect password.From workstation ws2025.socpedia.net we connect via RDP to sp.socpedia.net using …
Examples of computer account creation events
Events corresponding to suspicious activity are highlighted in yellow and red.Yellow - when using the cmdlet "New-ADComputer.Red - when running a PoC for the vulnerability "CertiGhost (CVE-2026-54121).