Loading...
SOCpedia Logo SOCpedia
Timelines

Брутфорс доменных учетныз записей по протоколу SMB

276 02.10.2026 13:58

Scanning via the SMB protocol from the attacker's non-domain workstation (192.168.0.234) to the domain workstation ws2025.socpedia.net.

Clear Filter
Matched Events: 205 / Total Events: 205
#1 2026-10-02 13:11:00

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
DC$
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-32-560} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-21-1838030176-2987033226-1986555923-1000} %{S-1-5-21-1838030176-2987033226-1986555923-516} %{S-1-5-9} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-16384}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-18
New Logon: Account Name
DC$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715eb76
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-32-560} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-21-1838030176-2987033226-1986555923-1000} %{S-1-5-21-1838030176-2987033226-1986555923-516} %{S-1-5-9} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-16384}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
8548
#2 2026-10-02 13:11:00

Special privileges assigned to new logon (4672 "Security")

192.168.0.210
DC.socpedia.net
DC$
Privileges
SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege SeEnableDelegationPrivilege
Subject: Security ID
S-1-5-18
Subject: Account Name
DC$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1715eb76
Privileges
SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege SeEnableDelegationPrivilege
Computer
DC.socpedia.net
ProcessPID
844
IP
192.168.0.210
ThreadID
8548
#3 2026-10-02 13:11:00

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
DC$
Network Information: Source Network Address
::1
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-18
New Logon: Account Name
DC$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715eb76
Account Information: Logon GUID
{9d570afc-80e2-6090-bdf8-ba428adc31d0}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
::1
Network Information: Client Port
55412
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
8548
#4 2026-10-02 13:11:00

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
DC$
Logon Type
3
Subject: Security ID
S-1-5-18
Subject: Account Name
DC$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1715eb76
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#5 2026-10-02 13:11:01

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#6 2026-10-02 13:11:01

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-d09e-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-491e-97e09b45dd01}
Status
0xc000000d
Translated Status
0xc000000d
Client Address Length
15
Client Address
0200D8EEC0A800EA0000000000000000
Session ID
0x580004000045
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#7 2026-10-02 13:11:01

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Detailed Authentication Information: Account Domain
-
Failure Information: Failure Reason
%%2304
Failure Information: Status
0x80090308
Failure Information: Sub Status
0x0
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
55534
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#8 2026-10-02 13:11:03

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55528
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:01.335
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#9 2026-10-02 13:11:03

The server denied anonymous access to the client (1009 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Client Address Length
15
Client Address
0200D8EEC0A800EA0000000000000000
Client Name Length
15
Client Name
\\192.168.0.234
Session ID
0x0
Session GUID
{00000000-0000-0000-0000-000000000000}
Connection GUID
{e071c1cb-459b-0000-491e-97e09b45dd01}
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
952
#10 2026-10-02 13:11:03

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#11 2026-10-02 13:11:03

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
WS2025$
Network Information: Source Network Address
192.168.0.231
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1136
New Logon: Account Name
WS2025$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715ebf4
Account Information: Logon GUID
{bb382426-b382-25ac-0f65-c8b8e161259e}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.231
Network Information: Client Port
64012
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#12 2026-10-02 13:11:03

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
WS2025$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1136
New Logon: Account Name
WS2025$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1715ebf4
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#13 2026-10-02 13:11:03

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
dc_admin
User
dc_admin
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#14 2026-10-02 13:11:03

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
dc_admin
Error Code
0xc000006a
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
dc_admin
Error Code
0xc000006a
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#15 2026-10-02 13:11:03

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
dc_admin
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
dc_admin
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#16 2026-10-02 13:11:03

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
dc_admin
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
dc_admin
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc000006a
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
55554
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#17 2026-10-02 13:11:03

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-1a9f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-4b1e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200D902C0A800EA0000000000000000
Session ID
0x580004000049
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#18 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55548
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:03.684
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#19 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
135
DestinationPortName
epmap
Image
C:\Windows\System32\lsass.exe
Initiated
true
Process GUID
{93585ce4-2888-6aaa-0c00-000000001800}
Process ID
860
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
ws2025.socpedia.net
SourceIp
192.168.0.231
SourceIsIpv6
false
SourcePort
64011
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:03.700
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#20 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55554
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:03.685
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#21 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
135
DestinationPortName
epmap
Image
C:\Windows\System32\svchost.exe
Initiated
false
Process GUID
{93585ce4-288d-6aaa-1000-000000001800}
Process ID
564
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55762
SourcePortName
-
User
NT AUTHORITY\NETWORK SERVICE
UTC Time
2026-10-02 08:12:03.354
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#22 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
49693
DestinationPortName
-
Image
C:\Windows\System32\lsass.exe
Initiated
true
Process GUID
{93585ce4-2888-6aaa-0c00-000000001800}
Process ID
860
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
ws2025.socpedia.net
SourceIp
192.168.0.231
SourceIsIpv6
false
SourcePort
64012
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:03.704
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#23 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
135
DestinationPortName
epmap
Image
C:\Windows\System32\svchost.exe
Initiated
false
Process GUID
{d062d9b1-286e-6aaa-0e00-000000000b00}
Process ID
988
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
WS2025
SourceIp
192.168.0.231
SourceIsIpv6
false
SourcePort
64011
SourcePortName
-
User
NT AUTHORITY\NETWORK SERVICE
UTC Time
2026-10-02 08:12:03.716
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
4552
#24 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
49693
DestinationPortName
-
Image
C:\Windows\System32\lsass.exe
Initiated
false
Process GUID
{d062d9b1-2863-6aaa-0c00-000000000b00}
Process ID
844
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
WS2025
SourceIp
192.168.0.231
SourceIsIpv6
false
SourcePort
64012
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:03.720
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
4552
#25 2026-10-02 13:11:05

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#26 2026-10-02 13:11:05

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
cs_admin
User
cs_admin
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#27 2026-10-02 13:11:05

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
cs_admin
Error Code
0xc000006a
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
cs_admin
Error Code
0xc000006a
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#28 2026-10-02 13:11:05

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-409f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-4e1e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200D910C0A800EA0000000000000000
Session ID
0x58000400004d
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#29 2026-10-02 13:11:05

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
cs_admin
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
cs_admin
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#30 2026-10-02 13:11:05

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
cs_admin
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
cs_admin
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc000006a
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
55568
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#31 2026-10-02 13:11:07

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55568
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:05.703
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#32 2026-10-02 13:11:07

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55564
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:05.701
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#33 2026-10-02 13:11:07

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#34 2026-10-02 13:11:07

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
root
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
root
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#35 2026-10-02 13:11:07

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
root
User
root
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#36 2026-10-02 13:11:07

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-459f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-4f1e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200D918C0A800EA0000000000000000
Session ID
0x580004000051
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#37 2026-10-02 13:11:07

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
root
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
root
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
55576
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#38 2026-10-02 13:11:07

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
root
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
root
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#39 2026-10-02 13:11:09

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#40 2026-10-02 13:11:09

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
admin
User
admin
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#41 2026-10-02 13:11:09

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
admin
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
admin
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#42 2026-10-02 13:11:09

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
admin
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
admin
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#43 2026-10-02 13:11:09

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-6b9f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-521e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200D928C0A800EA0000000000000000
Session ID
0x580004000055
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#44 2026-10-02 13:11:09

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
admin
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
admin
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
55592
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#45 2026-10-02 13:11:09

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55570
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:07.718
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#46 2026-10-02 13:11:09

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55576
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:07.720
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#47 2026-10-02 13:11:10

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55578
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:09.735
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#48 2026-10-02 13:11:10

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
55592
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:09.737
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#49 2026-10-02 13:11:11

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#50 2026-10-02 13:11:11

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
test
User
test
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#51 2026-10-02 13:11:11

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
test
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
test
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#52 2026-10-02 13:11:11

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
test
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
test
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
47488
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#53 2026-10-02 13:11:11

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
test
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
test
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#54 2026-10-02 13:11:11

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-709f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-531e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200B980C0A800EA0000000000000000
Session ID
0x580004000059
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#55 2026-10-02 13:11:12

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
47486
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:11.752
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#56 2026-10-02 13:11:13

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#57 2026-10-02 13:11:13

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
guest
User
guest
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#58 2026-10-02 13:11:13

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
guest
Error Code
0xc000006a
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
guest
Error Code
0xc000006a
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#59 2026-10-02 13:11:13

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.231
ws2025.socpedia.net
guest
Error Code
0xc000006a
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
guest
Error Code
0xc000006a
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#60 2026-10-02 13:11:13

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
guest
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
guest
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc000006a
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
47508
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#61 2026-10-02 13:11:13

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
guest
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
guest
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#62 2026-10-02 13:11:13

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-969f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-561e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200B994C0A800EA0000000000000000
Session ID
0x58000400005d
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#63 2026-10-02 13:11:14

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
47496
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:13.768
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#64 2026-10-02 13:11:14

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
47508
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:13.769
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#65 2026-10-02 13:11:15

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#66 2026-10-02 13:11:15

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
info
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
info
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#67 2026-10-02 13:11:15

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
info
User
info
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#68 2026-10-02 13:11:15

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-bc9f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-591e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200B9ACC0A800EA0000000000000000
Session ID
0x580004000061
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#69 2026-10-02 13:11:15

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
info
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
info
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
47532
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#70 2026-10-02 13:11:15

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
info
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
info
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#71 2026-10-02 13:11:17

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
47524
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:15.784
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#72 2026-10-02 13:11:17

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#73 2026-10-02 13:11:17

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
adm
User
adm
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#74 2026-10-02 13:11:17

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
adm
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
adm
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#75 2026-10-02 13:11:17

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
adm
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
adm
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
47542
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#76 2026-10-02 13:11:17

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
adm
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
adm
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#77 2026-10-02 13:11:17

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-bf9f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-5a1e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200B9B6C0A800EA0000000000000000
Session ID
0x580004000065
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#78 2026-10-02 13:11:19

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
47542
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:17.802
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#79 2026-10-02 13:11:19

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#80 2026-10-02 13:11:19

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
mysql
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
mysql
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#81 2026-10-02 13:11:19

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
mysql
User
mysql
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#82 2026-10-02 13:11:19

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
mysql
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
mysql
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
47550
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#83 2026-10-02 13:11:19

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-f39f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-7f1e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200B9BEC0A800EA0000000000000000
Session ID
0x580004000069
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#84 2026-10-02 13:11:19

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
mysql
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
mysql
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#85 2026-10-02 13:11:21

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#86 2026-10-02 13:11:21

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
user
User
user
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#87 2026-10-02 13:11:21

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
user
Error Code
0xc0000064
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
user
Error Code
0xc0000064
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#88 2026-10-02 13:11:21

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
user
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
user
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc0000064
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
52344
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#89 2026-10-02 13:11:21

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-f69f-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-821e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200CC78C0A800EA0000000000000000
Session ID
0x58000400006d
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#90 2026-10-02 13:11:21

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
user
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
user
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#91 2026-10-02 13:11:21

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
47548
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:19.817
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#92 2026-10-02 13:11:21

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
47550
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:19.819
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#93 2026-10-02 13:11:22

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52344
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:21.835
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#94 2026-10-02 13:11:22

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationHostname
ws2025.socpedia.net
DestinationIp
192.168.0.231
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{93585ce4-2878-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.234
SourceIsIpv6
false
SourcePort
52334
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-10-02 08:12:21.833
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
3344
ThreadID
3412
#95 2026-10-02 13:11:23

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
WS2025$
Calling process name
-
Calling process name
-
PID
4
Calling process user identity
WS2025$
Calling process domain identity
SOCPEDIA
Mechanism
1.3.6.1.4.1.311.2.2.10
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#96 2026-10-02 13:11:23

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210
DC.socpedia.net
user02
User
user02
Domain
socpedia.net
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#97 2026-10-02 13:11:23

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210
DC.socpedia.net
user02
Error Code
0xc000006a
Authentication Package
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account
user02
Error Code
0xc000006a
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
4144
#98 2026-10-02 13:11:23

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231
ws2025.socpedia.net
user02
Remote Client Information: Client IP
192.168.0.234
Process Information: Process Name
SYSTEM
Process ID
860
Remote Client Information: Username
user02
Remote Client Information: Domain
socpedia.net
Remote Client Information: Client Machine
Null
Remote Client Information: Client IP
192.168.0.234
Remote Client Information: Client Network Name
Null
NTLM Security: Negotiated Flags
0xa0880205
NTLM Security: NTLM Version
NTLMv2
NTLM Security: Session Key Status
Missing
NTLM Security: Channel Binding
Not Supported
NTLM Security: Service Binding
ws2025.socpedia.net
NTLM Security: Target Machine
socpedia.net
NTLM Security: Target Domain
cifs/ws2025.socpedia.net
NTLM Security: MIC Status
Unprotected
NTLM Security: AvlFlags
0x0
NTLM Security: AvlFlags String
None
Status
0xc000006d
Status Message
3221225581
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952
#99 2026-10-02 13:11:23

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231
ws2025.socpedia.net
Client Name
\\192.168.0.234
Session GUID
{e071c1cb-459b-0003-1ea0-b0e09b45dd01}
Connection GUID
{e071c1cb-459b-0000-831e-97e09b45dd01}
Status
0xc000006d
Translated Status
0xc000006d
Client Address Length
15
Client Address
0200CC92C0A800EA0000000000000000
Session ID
0x580004000071
UserName Length
15
Client Name Length
15
Client Name
\\192.168.0.234
SPN
session setup failed before the SPN could be queried
SPN Validation Policy
0
ReasonCode
3
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
4
ThreadID
6080
#100 2026-10-02 13:11:23

An account failed to log on (4625 "Security")

192.168.0.231
ws2025.socpedia.net
user02
Network Information: Source Network Address
192.168.0.234
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
Account For Which Logon Failed: Security ID
S-1-0-0
Account For Which Logon Failed: Account Name
user02
Detailed Authentication Information: Account Domain
socpedia.net
Failure Information: Failure Reason
%%2313
Failure Information: Status
0xc000006d
Failure Information: Sub Status
0xc000006a
Process Information: Caller Process ID
0x0
Process Information: Caller Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.234
Network Information: Source Port
52370
Detailed Authentication Information: Logon Process
NtLmSsp
Detailed Authentication Information: Authentication Package
NTLM
Detailed Authentication Information: Transited Services
-
Detailed Authentication Information: Package Name (NTLM only)
-
Detailed Authentication Information: Key Length
0
IP
192.168.0.231
Computer
ws2025.socpedia.net
ProcessPID
860
ThreadID
3952

SOCpedia - knowledge platform

This section contains materials on SOC and Blue Team practices: articles, news, books, and translations.

News Blog SOCpedia Library