Брутфорс доменных учетныз записей по протоколу SMB

265 02.10.2026 13:58

Scanning via the SMB protocol from the attacker's non-domain workstation (192.168.0.234) to the domain workstation ws2025.socpedia.net.

Clear Filter

Field

Value	Occurrences	Events

Quick search

Select fields and values for a fast timeline filter.

Fields

Advanced search

Build field conditions with AND, OR, and AND NOT.

Groups operator

Parameter description and example

Groups operator Combines groups at the top level: AND requires every group, OR requires at least one group.

Operator Inside a group, AND requires every condition, OR requires at least one condition, and AND NOT excludes matching events.

Field The event field to check, for example Event ID, Event title, AuthenticationPackageName, or IpAddress.

Condition contains / not contain search inside text, equals / not equals compare full value, exists checks that the field has a value, empty checks that it does not.

Values OR matches any entered value. AND requires all entered values to match the same field.

Search Values Type a value and press Enter to add it. Added values can be removed individually. The field is ignored for exists and empty.

Example

Find successful logon events, but exclude localhost activity:

Event ID equals 4624
OR Event title contains logon
AND NOT IpAddress equals 127.0.0.1

No advanced conditions.

Share Filter File

Import

Matched Events: 205 / Total Events: 205

#201 2026-10-02 13:11:43

Неопределено (4000 "Microsoft-Windows-SMBServer/Connectivity") Undefined

192.168.0.231

No Mapped Primary Fields.

#202 2026-10-02 13:11:43

An account was logged off (4634 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Logon Type

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x15b863c5
Logon Type: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 1816

#203 2026-10-02 13:11:45

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 42806
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:44.017
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#204 2026-10-02 13:11:45

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 42820
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:44.018
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#205 2026-10-02 13:11:54

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

WS2025$

Logon Type

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1136
Subject: Account Name: WS2025$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1715ebf4
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

Event Title
Event ID
Access Request Information: Accesses
Account Whose Credentials Were Used: Account Domain
Authentication Package
AvFlags
AvlFlags String
Calling process domain identity
Calling Process Name
Calling process PID
Calling process user identity
Client Address
Client Address Length
Client certificate thumbprint
Client Name
Client Name Length
Computer
Connection GUID
Connection ID
Connection Type
Creator Subject: Account Domain
Creator Subject: Account Name
Creator Subject: Logon ID
DestinationHostname
DestinationIp
DestinationIsIpv6
DestinationPort
DestinationPortName
Detailed Authentication Information: Authentication Package
Detailed Authentication Information: Logon Process
Detailed Authentication Information: Transited Services
Failure Reason
GroupMembership
Image
ImpersonationLevel
Initiated
Instance Name
IP
Key Length
LM Package Name
Local Address
Logon Information: Remote Credential Guard
Logon Information: Restricted Admin Mode
Logon Type
Mechanism
MIC Status
Network Information: Source Network Address
Network Information: Source Port
Network Information: Workstation Name
New Logon: Logon GUID
New Logon: Logon ID
NTLM Security: Channel Binding
NTLM Security: Negotiated Flags
NTLM Security: Session Key Status
NTLM Version
Object: Object Type
Port Origin
Process
Process GUID
Process ID
Process: Process ID
ProcessPID
Protocol
ReasonCode
Remote Address
Remote Client Information: Client IP
Remote Client Information: Client Network Name
Remote Client Information: Domain
Remote Client Machine
Requested Operation: Desired Access
Requested Operation: Privileges
Rule Name
Server name
Service Binding
Service Host Tag
Session GUID
Session ID
Session ID
Share Information: Share Name
Share Information: Share Path
Source Workstation
SourceHostname
SourceIp
SourceIsIpv6
SourcePort
SourcePortName
SPN
SPN Validation Policy
Status
Status Message
Sub Status
Subject: Account Name
Subject: Security ID
Target Domain
Target Machine
Target Subject: Security ID
ThreadID
Translated Status
User
User
Username
UserName Length
UTC Time

Брутфорс доменных учетныз записей по протоколу SMB

Неопределено (4000 "Microsoft-Windows-SMBServer/Connectivity") Undefined

An account was logged off (4634 "Security")

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

An account was logged off (4634 "Security")

SOCpedia - knowledge platform