Брутфорс доменных учетныз записей по протоколу SMB

#1 2026-10-02 13:11:00

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

DC$

GroupMembership

%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-32-560} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-21-1838030176-2987033226-1986555923-1000} %{S-1-5-21-1838030176-2987033226-1986555923-516} %{S-1-5-9} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-16384}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-18
New Logon: Account Name: DC$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1715eb76
GroupMembership: %{S-1-5-32-544} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-32-560} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-21-1838030176-2987033226-1986555923-1000} %{S-1-5-21-1838030176-2987033226-1986555923-516} %{S-1-5-9} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-16384}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 8548

#2 2026-10-02 13:11:00

Special privileges assigned to new logon (4672 "Security")

192.168.0.210

DC.socpedia.net

DC$

Privileges

SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege SeEnableDelegationPrivilege

Subject: Security ID: S-1-5-18
Subject: Account Name: DC$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1715eb76
Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege SeEnableDelegationPrivilege
Computer: DC.socpedia.net
ProcessPID: 844
IP: 192.168.0.210
ThreadID: 8548

#3 2026-10-02 13:11:00

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

DC$

Network Information: Source Network Address

::1

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-18
New Logon: Account Name: DC$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1715eb76
Account Information: Logon GUID: {9d570afc-80e2-6090-bdf8-ba428adc31d0}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: ::1
Network Information: Client Port: 55412
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 8548

#4 2026-10-02 13:11:00

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

DC$

Logon Type

3

Subject: Security ID: S-1-5-18
Subject: Account Name: DC$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1715eb76
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#5 2026-10-02 13:11:01

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#6 2026-10-02 13:11:01

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-d09e-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-491e-97e09b45dd01}
Status: 0xc000000d
Translated Status: 0xc000000d
Client Address Length: 15
Client Address: 0200D8EEC0A800EA0000000000000000
Session ID: 0x580004000045
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#7 2026-10-02 13:11:01

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Detailed Authentication Information: Account Domain: -
Failure Information: Failure Reason: %%2304
Failure Information: Status: 0x80090308
Failure Information: Sub Status: 0x0
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 55534
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#8 2026-10-02 13:11:03

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55528
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:01.335
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#9 2026-10-02 13:11:03

The server denied anonymous access to the client (1009 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Client Address Length: 15
Client Address: 0200D8EEC0A800EA0000000000000000
Client Name Length: 15
Client Name: \\192.168.0.234
Session ID: 0x0
Session GUID: {00000000-0000-0000-0000-000000000000}
Connection GUID: {e071c1cb-459b-0000-491e-97e09b45dd01}
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 952

#10 2026-10-02 13:11:03

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#11 2026-10-02 13:11:03

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

WS2025$

Network Information: Source Network Address

192.168.0.231

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1136
New Logon: Account Name: WS2025$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1715ebf4
Account Information: Logon GUID: {bb382426-b382-25ac-0f65-c8b8e161259e}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.231
Network Information: Client Port: 64012
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#12 2026-10-02 13:11:03

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

WS2025$

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1136
New Logon: Account Name: WS2025$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1715ebf4
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#13 2026-10-02 13:11:03

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

dc_admin

User: dc_admin
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#14 2026-10-02 13:11:03

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

dc_admin

Error Code

0xc000006a

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: dc_admin
Error Code: 0xc000006a
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#15 2026-10-02 13:11:03

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

dc_admin

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: dc_admin
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#16 2026-10-02 13:11:03

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

dc_admin

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: dc_admin
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc000006a
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 55554
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#17 2026-10-02 13:11:03

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-1a9f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-4b1e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200D902C0A800EA0000000000000000
Session ID: 0x580004000049
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#18 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55548
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:03.684
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#19 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 135
DestinationPortName: epmap
Image: C:\Windows\System32\lsass.exe
Initiated: true
Process GUID: {93585ce4-2888-6aaa-0c00-000000001800}
Process ID: 860
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: ws2025.socpedia.net
SourceIp: 192.168.0.231
SourceIsIpv6: false
SourcePort: 64011
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:03.700
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#20 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55554
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:03.685
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#21 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 135
DestinationPortName: epmap
Image: C:\Windows\System32\svchost.exe
Initiated: false
Process GUID: {93585ce4-288d-6aaa-1000-000000001800}
Process ID: 564
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55762
SourcePortName: -
User: NT AUTHORITY\NETWORK SERVICE
UTC Time: 2026-10-02 08:12:03.354
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#22 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 49693
DestinationPortName: -
Image: C:\Windows\System32\lsass.exe
Initiated: true
Process GUID: {93585ce4-2888-6aaa-0c00-000000001800}
Process ID: 860
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: ws2025.socpedia.net
SourceIp: 192.168.0.231
SourceIsIpv6: false
SourcePort: 64012
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:03.704
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#23 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC.socpedia.net
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 135
DestinationPortName: epmap
Image: C:\Windows\System32\svchost.exe
Initiated: false
Process GUID: {d062d9b1-286e-6aaa-0e00-000000000b00}
Process ID: 988
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: WS2025
SourceIp: 192.168.0.231
SourceIsIpv6: false
SourcePort: 64011
SourcePortName: -
User: NT AUTHORITY\NETWORK SERVICE
UTC Time: 2026-10-02 08:12:03.716
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 4552

#24 2026-10-02 13:11:05

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC.socpedia.net
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 49693
DestinationPortName: -
Image: C:\Windows\System32\lsass.exe
Initiated: false
Process GUID: {d062d9b1-2863-6aaa-0c00-000000000b00}
Process ID: 844
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: WS2025
SourceIp: 192.168.0.231
SourceIsIpv6: false
SourcePort: 64012
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:03.720
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 4552

#25 2026-10-02 13:11:05

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#26 2026-10-02 13:11:05

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

cs_admin

User: cs_admin
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#27 2026-10-02 13:11:05

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

cs_admin

Error Code

0xc000006a

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: cs_admin
Error Code: 0xc000006a
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#28 2026-10-02 13:11:05

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-409f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-4e1e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200D910C0A800EA0000000000000000
Session ID: 0x58000400004d
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#29 2026-10-02 13:11:05

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

cs_admin

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: cs_admin
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#30 2026-10-02 13:11:05

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

cs_admin

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: cs_admin
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc000006a
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 55568
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#31 2026-10-02 13:11:07

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55568
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:05.703
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#32 2026-10-02 13:11:07

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55564
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:05.701
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#33 2026-10-02 13:11:07

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#34 2026-10-02 13:11:07

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

root

Error Code

0xc0000064

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: root
Error Code: 0xc0000064
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#35 2026-10-02 13:11:07

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

root

User: root
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#36 2026-10-02 13:11:07

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-459f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-4f1e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200D918C0A800EA0000000000000000
Session ID: 0x580004000051
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#37 2026-10-02 13:11:07

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

root

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: root
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc0000064
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 55576
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#38 2026-10-02 13:11:07

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

root

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: root
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#39 2026-10-02 13:11:09

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#40 2026-10-02 13:11:09

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

admin

User: admin
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#41 2026-10-02 13:11:09

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

admin

Error Code

0xc0000064

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: admin
Error Code: 0xc0000064
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#42 2026-10-02 13:11:09

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

admin

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: admin
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#43 2026-10-02 13:11:09

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-6b9f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-521e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200D928C0A800EA0000000000000000
Session ID: 0x580004000055
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#44 2026-10-02 13:11:09

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

admin

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: admin
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc0000064
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 55592
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#45 2026-10-02 13:11:09

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55570
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:07.718
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#46 2026-10-02 13:11:09

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55576
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:07.720
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#47 2026-10-02 13:11:10

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55578
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:09.735
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#48 2026-10-02 13:11:10

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 55592
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:09.737
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#49 2026-10-02 13:11:11

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#50 2026-10-02 13:11:11

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

test

User: test
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#51 2026-10-02 13:11:11

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

test

Error Code

0xc0000064

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: test
Error Code: 0xc0000064
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#52 2026-10-02 13:11:11

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

test

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: test
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc0000064
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 47488
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#53 2026-10-02 13:11:11

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

test

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: test
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#54 2026-10-02 13:11:11

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-709f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-531e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200B980C0A800EA0000000000000000
Session ID: 0x580004000059
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#55 2026-10-02 13:11:12

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 47486
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:11.752
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#56 2026-10-02 13:11:13

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#57 2026-10-02 13:11:13

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

guest

User: guest
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#58 2026-10-02 13:11:13

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

guest

Error Code

0xc000006a

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: guest
Error Code: 0xc000006a
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#59 2026-10-02 13:11:13

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.231

ws2025.socpedia.net

guest

Error Code

0xc000006a

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: guest
Error Code: 0xc000006a
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#60 2026-10-02 13:11:13

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

guest

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: guest
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc000006a
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 47508
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#61 2026-10-02 13:11:13

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

guest

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: guest
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#62 2026-10-02 13:11:13

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-969f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-561e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200B994C0A800EA0000000000000000
Session ID: 0x58000400005d
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#63 2026-10-02 13:11:14

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 47496
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:13.768
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#64 2026-10-02 13:11:14

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 47508
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:13.769
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#65 2026-10-02 13:11:15

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#66 2026-10-02 13:11:15

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

info

Error Code

0xc0000064

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: info
Error Code: 0xc0000064
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#67 2026-10-02 13:11:15

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

info

User: info
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#68 2026-10-02 13:11:15

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-bc9f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-591e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200B9ACC0A800EA0000000000000000
Session ID: 0x580004000061
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#69 2026-10-02 13:11:15

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

info

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: info
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc0000064
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 47532
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#70 2026-10-02 13:11:15

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

info

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: info
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#71 2026-10-02 13:11:17

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 47524
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:15.784
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#72 2026-10-02 13:11:17

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#73 2026-10-02 13:11:17

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

adm

User: adm
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#74 2026-10-02 13:11:17

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

adm

Error Code

0xc0000064

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: adm
Error Code: 0xc0000064
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#75 2026-10-02 13:11:17

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

adm

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: adm
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc0000064
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 47542
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#76 2026-10-02 13:11:17

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

adm

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: adm
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#77 2026-10-02 13:11:17

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-bf9f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-5a1e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200B9B6C0A800EA0000000000000000
Session ID: 0x580004000065
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#78 2026-10-02 13:11:19

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 47542
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:17.802
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#79 2026-10-02 13:11:19

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#80 2026-10-02 13:11:19

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

mysql

Error Code

0xc0000064

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: mysql
Error Code: 0xc0000064
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#81 2026-10-02 13:11:19

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

mysql

User: mysql
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#82 2026-10-02 13:11:19

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

mysql

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: mysql
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc0000064
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 47550
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#83 2026-10-02 13:11:19

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-f39f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-7f1e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200B9BEC0A800EA0000000000000000
Session ID: 0x580004000069
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#84 2026-10-02 13:11:19

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

mysql

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: mysql
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#85 2026-10-02 13:11:21

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#86 2026-10-02 13:11:21

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

user

User: user
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#87 2026-10-02 13:11:21

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

user

Error Code

0xc0000064

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: user
Error Code: 0xc0000064
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#88 2026-10-02 13:11:21

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

user

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: user
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc0000064
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 52344
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#89 2026-10-02 13:11:21

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-f69f-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-821e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200CC78C0A800EA0000000000000000
Session ID: 0x58000400006d
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#90 2026-10-02 13:11:21

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

user

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: user
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#91 2026-10-02 13:11:21

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 47548
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:19.817
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#92 2026-10-02 13:11:21

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 47550
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:19.819
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#93 2026-10-02 13:11:22

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 52344
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:21.835
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#94 2026-10-02 13:11:22

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

DestinationIp

192.168.0.231

DestinationHostname: ws2025.socpedia.net
DestinationIp: 192.168.0.231
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {93585ce4-2878-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.234
SourceIsIpv6: false
SourcePort: 52334
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-10-02 08:12:21.833
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 3412

#95 2026-10-02 13:11:23

Network security: Restrict NTLM: Audit Incoming NTLM Traffic (8002 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

WS2025$

Calling process name

-

Calling process name: -
PID: 4
Calling process user identity: WS2025$
Calling process domain identity: SOCPEDIA
Mechanism: 1.3.6.1.4.1.311.2.2.10
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#96 2026-10-02 13:11:23

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller (8004 "Microsoft-Windows-NTLM/Operational")

192.168.0.210

DC.socpedia.net

user02

User: user02
Domain: socpedia.net
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#97 2026-10-02 13:11:23

The computer attempted to validate the credentials for an account (4776 "Security")

192.168.0.210

DC.socpedia.net

user02

Error Code

0xc000006a

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: user02
Error Code: 0xc000006a
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 4144

#98 2026-10-02 13:11:23

A remote client is using NTLM to authenticate to this workstation (4023 "Microsoft-Windows-NTLM/Operational")

192.168.0.231

ws2025.socpedia.net

user02

Remote Client Information: Client IP

192.168.0.234

Process Information: Process Name: SYSTEM
Process ID: 860
Remote Client Information: Username: user02
Remote Client Information: Domain: socpedia.net
Remote Client Information: Client Machine: Null
Remote Client Information: Client IP: 192.168.0.234
Remote Client Information: Client Network Name: Null
NTLM Security: Negotiated Flags: 0xa0880205
NTLM Security: NTLM Version: NTLMv2
NTLM Security: Session Key Status: Missing
NTLM Security: Channel Binding: Not Supported
NTLM Security: Service Binding: ws2025.socpedia.net
NTLM Security: Target Machine: socpedia.net
NTLM Security: Target Domain: cifs/ws2025.socpedia.net
NTLM Security: MIC Status: Unprotected
NTLM Security: AvlFlags: 0x0
NTLM Security: AvlFlags String: None
Status: 0xc000006d
Status Message: 3221225581
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#99 2026-10-02 13:11:23

SMB Session Authentication Failure (551 "Microsoft-Windows-SMBServer/Security")

192.168.0.231

ws2025.socpedia.net

Client Name

\\192.168.0.234

Session GUID: {e071c1cb-459b-0003-1ea0-b0e09b45dd01}
Connection GUID: {e071c1cb-459b-0000-831e-97e09b45dd01}
Status: 0xc000006d
Translated Status: 0xc000006d
Client Address Length: 15
Client Address: 0200CC92C0A800EA0000000000000000
Session ID: 0x580004000071
UserName Length: 15
Client Name Length: 15
Client Name: \\192.168.0.234
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: 0
ReasonCode: 3
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 6080

#100 2026-10-02 13:11:23

An account failed to log on (4625 "Security")

192.168.0.231

ws2025.socpedia.net

user02

Network Information: Source Network Address

192.168.0.234

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0
Account For Which Logon Failed: Account Name: user02
Detailed Authentication Information: Account Domain: socpedia.net
Failure Information: Failure Reason: %%2313
Failure Information: Status: 0xc000006d
Failure Information: Sub Status: 0xc000006a
Process Information: Caller Process ID: 0x0
Process Information: Caller Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.234
Network Information: Source Port: 52370
Detailed Authentication Information: Logon Process: NtLmSsp
Detailed Authentication Information: Authentication Package: NTLM
Detailed Authentication Information: Transited Services: -
Detailed Authentication Information: Package Name (NTLM only): -
Detailed Authentication Information: Key Length: 0
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

Оқиға атауы
Оқиға ID
Access Request Information: Accesses
Account Whose Credentials Were Used: Account Domain
Authentication Package
AvFlags
AvlFlags String
Calling process domain identity
Calling Process Name
Calling process PID
Calling process user identity
Client Address
Client Address Length
Client certificate thumbprint
Client Name
Client Name Length
Computer
Connection GUID
Connection ID
Connection Type
Creator Subject: Account Domain
Creator Subject: Account Name
Creator Subject: Logon ID
DestinationHostname
DestinationIp
DestinationIsIpv6
DestinationPort
DestinationPortName
Detailed Authentication Information: Authentication Package
Detailed Authentication Information: Logon Process
Detailed Authentication Information: Transited Services
Failure Reason
GroupMembership
Image
ImpersonationLevel
Initiated
Instance Name
IP
Key Length
LM Package Name
Local Address
Logon Information: Remote Credential Guard
Logon Information: Restricted Admin Mode
Logon Type
Mechanism
MIC Status
Network Information: Source Network Address
Network Information: Source Port
Network Information: Workstation Name
New Logon: Logon GUID
New Logon: Logon ID
NTLM Security: Channel Binding
NTLM Security: Negotiated Flags
NTLM Security: Session Key Status
NTLM Version
Object: Object Type
Port Origin
Process
Process GUID
Process ID
Process: Process ID
ProcessPID
Protocol
ReasonCode
Remote Address
Remote Client Information: Client IP
Remote Client Information: Client Network Name
Remote Client Information: Domain
Remote Client Machine
Requested Operation: Desired Access
Requested Operation: Privileges
Rule Name
Server name
Service Binding
Service Host Tag
Session GUID
Session ID
Session ID
Share Information: Share Name
Share Information: Share Path
Source Workstation
SourceHostname
SourceIp
SourceIsIpv6
SourcePort
SourcePortName
SPN
SPN Validation Policy
Status
Status Message
Sub Status
Subject: Account Name
Subject: Security ID
Target Domain
Target Machine
Target Subject: Security ID
ThreadID
Translated Status
User
User
Username
UserName Length
UTC Time