Loading...
SOCpedia Logo SOCpedia
Timelines

Брутфорс доменных учетныз записей по протоколу SMB

263 02.10.2026 13:58

Scanning via the SMB protocol from the attacker's non-domain workstation (192.168.0.234) to the domain workstation ws2025.socpedia.net.

Clear Filter
Matched Events: 205 / Total Events: 205
#101 2026-10-02 13:11:24

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52356
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:23.850
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#102 2026-10-02 13:11:24

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52370
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:23.852
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#103 2026-10-02 13:11:25

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#104 2026-10-02 13:11:25

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
administrator
User
administrator
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#105 2026-10-02 13:11:25

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
administrator
Error Code
0xc000006a
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
administrator
Error Code
0xc000006a
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#106 2026-10-02 13:11:25

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0002-a32c-99e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-861e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200CCAEC0A800EA0000000000000000
Session ID
0x580004000075
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#107 2026-10-02 13:11:25

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
administrator
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
administrator
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc000006a
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
52398
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#108 2026-10-02 13:11:25

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
administrator
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
administrator
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#109 2026-10-02 13:11:27

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52398
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:25.868
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#110 2026-10-02 13:11:27

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52382
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:25.867
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#111 2026-10-02 13:11:27

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#112 2026-10-02 13:11:27

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
oracle
User
oracle
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#113 2026-10-02 13:11:27

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
oracle
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
oracle
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#114 2026-10-02 13:11:27

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
oracle
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
oracle
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
52414
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#115 2026-10-02 13:11:27

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-47a0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-881e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200CCBEC0A800EA0000000000000000
Session ID
0x580004000079
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#116 2026-10-02 13:11:27

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
oracle
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
oracle
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#117 2026-10-02 13:11:29

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52400
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:27.884
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#118 2026-10-02 13:11:29

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52414
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:27.886
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#119 2026-10-02 13:11:29

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#120 2026-10-02 13:11:29

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
ftp
User
ftp
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#121 2026-10-02 13:11:29

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
ftp
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
ftp
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#122 2026-10-02 13:11:29

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-70a0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-891e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200E514C0A800EA0000000000000000
Session ID
0x58000400007d
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#123 2026-10-02 13:11:29

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
ftp
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
ftp
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#124 2026-10-02 13:11:29

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
ftp
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
ftp
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
58644
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#125 2026-10-02 13:11:30

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
ADCS$
Network Information: Source Network Address
192.168.0.211
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1840
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1106
New Logon: Account Name
ADCS$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715ef9a
Account Information: Logon GUID
{a10ceaf8-8f46-0671-828b-59e7a78e895d}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.211
Network Information: Client Port
53264
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#126 2026-10-02 13:11:30

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
ADCS$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-554} %{S-1-5-32-545} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-517} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1106
New Logon: Account Name
ADCS$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715ef9a
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-554} %{S-1-5-32-545} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-517} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#127 2026-10-02 13:11:30

A network share object was accessed (5140 "Security")

192.168.0.210
DC.socpedia.net
ADCS$
Network Information: Source Network Address
192.168.0.211
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1106
Subject: Account Name
ADCS$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1715ef9a
Network Information: Object Type
File
Network Information: Source Network Address
192.168.0.211
Network Information: Client Port
53264
Share Information: Share Name
\\*\IPC$
Access Request Information: Access Mask
0x1
Access Request Information: Accesses
%%4416
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
2212
#128 2026-10-02 13:11:30

The SMB redirector selected the connection initiated with the following parameters (30830 "Microsoft-Windows-SmbClient/Connectivity")

192.168.0.231
ws2025.socpedia.net
Server name
DC.socpedia.net
Server name
DC.socpedia.net
Connection Type
1
Remote Address
020001BDC0A800D20000000000000000
Instance Name
\Device\LanmanRedirector
Port Origin
4
Error Code
0x0
IP
192.168.0.231
Computer
ws2025.socpedia.net
#129 2026-10-02 13:11:30

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
WS2025$
Network Information: Source Network Address
192.168.0.231
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1840
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1136
New Logon: Account Name
WS2025$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715efc0
Account Information: Logon GUID
{8517700c-5152-6f89-00bf-3ffbdb18cffe}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.231
Network Information: Client Port
64014
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#130 2026-10-02 13:11:30

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
WS2025$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1136
New Logon: Account Name
WS2025$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715efc0
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#131 2026-10-02 13:11:30

A network share object was accessed (5140 "Security")

192.168.0.210
DC.socpedia.net
WS2025$
Network Information: Source Network Address
192.168.0.231
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1136
Subject: Account Name
WS2025$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1715efc0
Network Information: Object Type
File
Network Information: Source Network Address
192.168.0.231
Network Information: Client Port
64014
Share Information: Share Name
\\*\IPC$
Access Request Information: Access Mask
0x1
Access Request Information: Accesses
%%4416
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
2212
#132 2026-10-02 13:11:30

Неопределено (30833 "Microsoft-Windows-SmbClient/Connectivity") Undefined

192.168.0.231

No Mapped Primary Fields.

#133 2026-10-02 13:11:31

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58644
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:29.904
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#134 2026-10-02 13:11:31

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58638
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:29.902
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#135 2026-10-02 13:11:31

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#136 2026-10-02 13:11:31

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
pi
User
pi
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#137 2026-10-02 13:11:31

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
pi
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
pi
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#138 2026-10-02 13:11:31

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
pi
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
pi
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#139 2026-10-02 13:11:31

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
pi
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
pi
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
58656
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#140 2026-10-02 13:11:31

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-7fa0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-8c1e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200E520C0A800EA0000000000000000
Session ID
0x580008000001
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#141 2026-10-02 13:11:32

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{d062d9b1-285a-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
WS2025
SourceIp
192.168.0.231
SourceIsIpv6
false
SourcePort
64014
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:30.671
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
4552
#142 2026-10-02 13:11:32

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
true
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
ws2025.socpedia.net
SourceIp
192.168.0.231
SourceIsIpv6
false
SourcePort
64014
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:30.656
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#143 2026-10-02 13:11:33

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58656
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:31.920
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#144 2026-10-02 13:11:33

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58650
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:31.918
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#145 2026-10-02 13:11:33

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#146 2026-10-02 13:11:33

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
puppet
User
puppet
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#147 2026-10-02 13:11:33

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
puppet
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
puppet
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#148 2026-10-02 13:11:33

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
puppet
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
puppet
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#149 2026-10-02 13:11:33

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-a5a0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-8f1e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200E540C0A800EA0000000000000000
Session ID
0x580008000005
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#150 2026-10-02 13:11:33

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
puppet
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
puppet
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
58688
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#151 2026-10-02 13:11:35

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58672
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:33.935
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#152 2026-10-02 13:11:35

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#153 2026-10-02 13:11:35

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
ansible
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
ansible
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#154 2026-10-02 13:11:35

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
ansible
User
ansible
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#155 2026-10-02 13:11:35

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
ansible
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
ansible
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#156 2026-10-02 13:11:35

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-cda0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-901e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200E54AC0A800EA0000000000000000
Session ID
0x580008000009
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#157 2026-10-02 13:11:35

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
ansible
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
ansible
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
58698
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#158 2026-10-02 13:11:37

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#159 2026-10-02 13:11:37

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
ec2-user
User
ec2-user
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#160 2026-10-02 13:11:37

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
ec2-user
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
ec2-user
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#161 2026-10-02 13:11:37

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
ec2-user
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
ec2-user
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
58722
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#162 2026-10-02 13:11:37

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
ec2-user
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
ec2-user
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#163 2026-10-02 13:11:37

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-d2a0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-911e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200E562C0A800EA0000000000000000
Session ID
0x58000800000d
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#164 2026-10-02 13:11:37

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58698
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:35.952
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#165 2026-10-02 13:11:37

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58694
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:35.951
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#166 2026-10-02 13:11:39

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
Calling Process Name
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#167 2026-10-02 13:11:39

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
Calling Process Name
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#168 2026-10-02 13:11:39

The SMB redirector selected the connection initiated with the following parameters (30830 "Microsoft-Windows-SmbClient/Connectivity")

192.168.0.210
DC.socpedia.net
Server name
DC.socpedia.net
Server name
DC.socpedia.net
Connection Type
1
Remote Address
170001BD00000000FE80000000000000D8D755624107C8EA0E000000
Instance Name
\Device\LanmanRedirector
Port Origin
4
Error Code
0x0
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
8152
#169 2026-10-02 13:11:39

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
Calling Process Name
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#170 2026-10-02 13:11:39

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
Calling Process Name
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#171 2026-10-02 13:11:39

A network share object was accessed (5140 "Security")

192.168.0.210
DC.socpedia.net
DC$
Network Information: Source Network Address
fe80::d8d7:5562:4107:c8ea
Subject: Security ID
S-1-5-20
Subject: Account Name
DC$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e4
Network Information: Object Type
File
Network Information: Source Network Address
fe80::d8d7:5562:4107:c8ea
Network Information: Client Port
55413
Share Information: Share Name
\\*\IPC$
Access Request Information: Access Mask
0x1
Access Request Information: Accesses
%%4416
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
4436
#172 2026-10-02 13:11:39

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
Calling Process Name
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#173 2026-10-02 13:11:39

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#174 2026-10-02 13:11:39

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
vagrant
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
vagrant
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#175 2026-10-02 13:11:39

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
vagrant
User
vagrant
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#176 2026-10-02 13:11:39

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
vagrant
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
vagrant
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#177 2026-10-02 13:11:39

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
vagrant
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
vagrant
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
42770
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#178 2026-10-02 13:11:39

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-f8a0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-931e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200A712C0A800EA0000000000000000
Session ID
0x580008000011
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#179 2026-10-02 13:11:40

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58706
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:37.967
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#180 2026-10-02 13:11:40

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
58722
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:37.969
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#181 2026-10-02 13:11:40

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
ADCS$
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1106
Subject: Account Name
ADCS$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1715ef9a
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#182 2026-10-02 13:11:41

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
42762
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:39.984
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#183 2026-10-02 13:11:41

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
42770
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:39.986
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#184 2026-10-02 13:11:41

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
WS2025$
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1136
Subject: Account Name
WS2025$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1715efc0
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
5212
#185 2026-10-02 13:11:41

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#186 2026-10-02 13:11:41

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
azureuser
User
azureuser
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#187 2026-10-02 13:11:41

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
azureuser
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
azureuser
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#188 2026-10-02 13:11:41

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
azureuser
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
azureuser
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#189 2026-10-02 13:11:41

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-fba0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-941e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200A72CC0A800EA0000000000000000
Session ID
0x580008000015
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#190 2026-10-02 13:11:41

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
azureuser
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
azureuser
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
42796
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#191 2026-10-02 13:11:43

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
42796
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:42.002
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#192 2026-10-02 13:11:43

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
42782
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:42.000
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#193 2026-10-02 13:11:43

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#194 2026-10-02 13:11:43

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
localadmin
User
localadmin
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#195 2026-10-02 13:11:43

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Error Code
0x0
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
localadmin
Error Code
0x0
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#196 2026-10-02 13:11:43

NTLM server blocked in the domain audit: Audit NTLM authentication in this domain (8003 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
localadmin
Process
-
User
localadmin
Domain
socpedia.net
Workstation
(NULL)
PID
4
Process
-
Logon type
3
Mechanism
(NULL)
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#197 2026-10-02 13:11:43

An account was successfully logged on (4624 "Security")

192.168.0.231
ws2025.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA
New Logon: Logon ID
0x15b863c5
Account Information: Logon GUID
{00000000-0000-0000-0000-000000000000}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Client Port
42820
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#198 2026-10-02 13:11:43

Group membership information (4627 "Security")

192.168.0.231
ws2025.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-64-10} %{S-1-16-8192}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA
New Logon: Logon ID
0x15b863c5
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-64-10} %{S-1-16-8192}
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#199 2026-10-02 13:11:43

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
localadmin
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
localadmin
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0x0
Status Message
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
1816
#200 2026-10-02 13:11:43

A network share object was accessed (5140 "Security")

192.168.0.231
ws2025.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x15b863c5
Network Information: Object Type
File
Network Information: Source Network Address
192.168.0.234
Network Information: Client Port
42820
Share Information: Share Name
\\*\IPC$
Access Request Information: Access Mask
0x1
Access Request Information: Accesses
%%4416
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
5308

SOCpedia - knowledge platform

This section contains materials on SOC and Blue Team practices: articles, news, books, and translations.

News Blog SOCpedia Library