Загрузка...
SOCpedia Logo SOCpedia
Таймлайны

Авторизация Kerberos

690 29.09.2026 20:50
  1. С рабочей станции ws2025.socpedia.net подключаемся по RDP к sp.socpedia.net под доменной учетной записью lacaladmin с неправильным паролем.
  2. С рабочей станции ws2025.socpedia.net подключаемся по RDP к sp.socpedia.net под доменной учетной записью lacaladmin с правильным паролем.

  3. На рабочей станции sp.socpedia.net выполняем SIgn out для учетной записи localadmin. 

    Жёлтым цветом выделены события, представляющие наибольший интерес для анализа активности.

Очистить фильтр
Найдено событий: 492 / Всего событий: 492
#101 2026-09-29 20:34:34

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
5
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#102 2026-09-29 20:34:34

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x814
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7556
#103 2026-09-29 20:34:34

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da8a-6abb-bb1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
2068
Parent Process ID
868
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#104 2026-09-29 20:34:34

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x14c0
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\wbem\WmiPrvSE.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7556
#105 2026-09-29 20:34:34

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
/QuitInfo:000000000000019C;0000000000000334;
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x1b14
Process Information: Creator Process ID
0xb78
Process Information: New Process Name
C:\Windows\System32\ctfmon.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
/QuitInfo:000000000000019C;0000000000000334;
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#106 2026-09-29 20:34:34

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Image
C:\Windows\System32\wbem\WmiPrvSE.exe
Process GUID
{88ea2655-da8a-6abb-bc1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
Wmiprvse.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=1C2257B37101207E6D11C3A0456CB068B736875D,SHA256=A926DFD215FB50B506C283B5A2277569BF5F653B16364633BEC6617366C3358C,IMPHASH=8D7EA263D3290D799C6832B08F7A3F21
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
5312
Parent Process ID
1000
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#107 2026-09-29 20:34:34

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
/QuitInfo:000000000000019C;0000000000000334;
Command Line
/QuitInfo:000000000000019C;0000000000000334;
Image
C:\Windows\System32\ctfmon.exe
Process GUID
{88ea2655-da8a-6abb-bd1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
CTFMON.EXE
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9cad-6ab2-3800-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=1B3F7B8416C54DA13A51086D7C49412983720B33,SHA256=6DB24A587D68F47705F6BFC5DE76BE716E6A1437C20EB55ACCF2D2ACCDF2A400,IMPHASH=B539389D4BE1DD68C8213A539FEB41FB
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
6932
Parent Process ID
2936
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#108 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#109 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#110 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#111 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#112 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#113 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#114 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#115 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#116 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#117 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#118 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#119 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#120 2026-09-29 20:34:34

A trusted logon process has been registered with the Local Security Authority (4611 "Security")

192.168.0.225
SP.socpedia.net
SP$
Logon Process Name
UserManager
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Process Name
UserManager
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#121 2026-09-29 20:34:34

Process Access (10 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Image
C:\WINDOWS\system32\winlogon.exe
RuleName
v1-0_io_T_Winlogon
UTC Time
2026-09-29 15:34:34.803
Source Process GUID
{88ea2655-9ca8-6ab2-0c00-000000000700}
Source Process ID
876
Source Thread ID
740
Source Image
C:\WINDOWS\system32\lsass.exe
Target Process GUID
{88ea2655-da88-6abb-b31d-000000000700}
Target Process ID
5908
Target Image
C:\WINDOWS\system32\winlogon.exe
Granted Access
0x1478
Call Trace
C:\WINDOWS\SYSTEM32\ntdll.dll+15f2c4|C:\WINDOWS\system32\lsasrv.dll+24e84|C:\WINDOWS\system32\lsasrv.dll+2487a|C:\WINDOWS\system32\lsasrv.dll+24473|C:\WINDOWS\SYSTEM32\SspiSrv.dll+1b9d|C:\WINDOWS\System32\RPCRT4.dll+d1913|C:\WINDOWS\System32\RPCRT4.dll+d618e|C:\WINDOWS\System32\RPCRT4.dll+85cdc|C:\WINDOWS\System32\RPCRT4.dll+83897|C:\WINDOWS\System32\RPCRT4.dll+360f4|C:\WINDOWS\System32\RPCRT4.dll+37108|C:\WINDOWS\System32\RPCRT4.dll+300b4|C:\WINDOWS\System32\RPCRT4.dll+3463a|C:\WINDOWS\System32\RPCRT4.dll+3a65c|C:\WINDOWS\System32\RPCRT4.dll+397e3|C:\WINDOWS\System32\RPCRT4.dll+38788|C:\WINDOWS\SYSTEM32\ntdll.dll+51683|C:\WINDOWS\SYSTEM32\ntdll.dll+51fa3|C:\WINDOWS\System32\KERNEL32.DLL+2dbe7|C:\WINDOWS\SYSTEM32\ntdll.dll+85a6c
Source User
NT AUTHORITY\SYSTEM
Target User
NT AUTHORITY\SYSTEM
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#122 2026-09-29 20:34:34

A Kerberos authentication ticket (TGT) was requested (4768 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
::ffff:192.168.0.225
Account Information: Account Name
localadmin
Account Information: Account Domain
SOCPEDIA.NET
Account Information: User ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Service Information: Service Name
krbtgt
Service Information: Service ID
S-1-5-21-1838030176-2987033226-1986555923-502
Additional Information: Ticket Options
0x40810010
Additional Information: Failure Code
0x0
Additional Information: Ticket Encryption Type
0x12
Additional Information: Pre-Authentication Type
2
Network Information: Source Network Address
::ffff:192.168.0.225
Network Information: Client Port
65531
Ticket information: Response ticket hash
+fNuCBxjLoDpilF2lQvjqChu2JfeqXkQ+ikNwjOJwpQ=
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3144
#123 2026-09-29 20:34:34

A Kerberos service ticket was requested (4769 "Security")

192.168.0.210
DC.socpedia.net
localadmin@SOCPEDIA.NET
Network Information: Client Address
::ffff:192.168.0.225
Account Information: Account Name
localadmin@SOCPEDIA.NET
Account Information: Account Domain
SOCPEDIA.NET
Account Information: Logon GUID
{18b2b576-b27c-f4fc-f5d7-98d115ee217a}
Service Information: Service Name
SP$
Service Information: Service ID
S-1-5-21-1838030176-2987033226-1986555923-1134
Network Information: Client Address
::ffff:192.168.0.225
Network Information: Source Port
65532
Additional Information: Ticket Options
0x40810000
Additional Information: Ticket Encryption Type
0x12
Additional Information: Failure Code
0x0
Additional Information: Transited Services
-
Ticket information: Request ticket hash
+fNuCBxjLoDpilF2lQvjqChu2JfeqXkQ+ikNwjOJwpQ=
Ticket information: Response ticket hash
AFmKg0YRmQG9Vi7EL+gX4fFJZRyOYP4AlJ3aPcrFdjo=
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3484
#124 2026-09-29 20:34:34

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-14} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-2-0} %{S-1-18-1} %{S-1-16-8192}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
10
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA
New Logon: Logon ID
0xa1beca3
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-14} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-2-0} %{S-1-18-1} %{S-1-16-8192}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#125 2026-09-29 20:34:34

A logon was attempted using explicit credentials (4648 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Network Information: Network Address
192.168.0.231
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Subject: Logon GUID
{00000000-0000-0000-0000-000000000000}
Account Whose Credentials Were Used: Account Name
localadmin
Account Whose Credentials Were Used: Account Domain
SOCPEDIA
Account Whose Credentials Were Used: Logon GUID
{18b2b576-b27c-f4fc-f5d7-98d115ee217a}
Target Server: Target Server Name
localhost
Target Server: Additional Information
localhost
Process Information: Process ID
0xacc
Process Information: Process Name
C:\Windows\System32\svchost.exe
Network Information: Network Address
192.168.0.231
Network Information: Port
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#126 2026-09-29 20:34:34

A trusted logon process has been registered with the Local Security Authority (4611 "Security")

192.168.0.225
SP.socpedia.net
SP$
Logon Process Name
UserManager
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Process Name
UserManager
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#127 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#128 2026-09-29 20:34:34

An account was successfully logged on (4624 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.231
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Information: Logon Type
10
Logon Information: Restricted Admin Mode
%%1843
Logon Information: Remote Credential Guard
%%1843
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA
New Logon: Logon ID
0xa1beca3
Account Information: Logon GUID
{18b2b576-b27c-f4fc-f5d7-98d115ee217a}
Process Information: Process ID
0xacc
Process Information: Process Name
C:\Windows\System32\svchost.exe
Network Information: Workstation Name
SP
Network Information: Source Network Address
192.168.0.231
Network Information: Client Port
0
Detailed Authentication Information: Logon Process
User32
Detailed Authentication Information: Authentication Package
Negotiate
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#129 2026-09-29 20:34:34

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
SP$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cea3
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#130 2026-09-29 20:34:34

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cea3
Account Information: Logon GUID
{79a5782e-8614-9316-0685-06f414871eb5}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
65534
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#131 2026-09-29 20:34:34

Begin session arbitration (41 "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Session ID
7
User
SOCPEDIA\localadmin
Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
940
ThreadID
5048
#132 2026-09-29 20:34:34

End session arbitration (42 "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Session ID
7
User
SOCPEDIA\localadmin
Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
940
ThreadID
5048
#133 2026-09-29 20:34:34

User Logon Notification for Customer Experience Improvement Program (7001 "System")

192.168.0.225
SP.socpedia.net
User SID
S-1-5-21-1838030176-2987033226-1986555923-1140
TS ID
7
User SID
S-1-5-21-1838030176-2987033226-1986555923-1140
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
5908
ThreadID
6760
#134 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Flags
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Flags
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#135 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\FullProfile
Details
DWORD (0x00000001)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\FullProfile
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#136 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Sid
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Sid
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#137 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\State
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\State
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#138 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeLow
Details
DWORD (0x07c8d2c9)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeLow
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#139 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeHigh
Details
DWORD (0x01dd5028)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeHigh
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#140 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeLow
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeLow
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.051
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#141 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeHigh
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeHigh
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.051
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#142 2026-09-29 20:34:35

A security-enabled local group membership was enumerated (4799 "Security")

192.168.0.225
SP.socpedia.net
SP$
Group: Group Name
Administrators
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Group: Security ID
S-1-5-32-544
Group: Group Name
Administrators
Group: Group Domain
Builtin
Process Information: Process ID
0x7c8
Process Information: Process Name
C:\Windows\System32\svchost.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#143 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDNSDOMAIN
Details
SOCPEDIA.NET
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDNSDOMAIN
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.074
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#144 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDOMAIN
Details
SOCPEDIA
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDOMAIN
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.074
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#145 2026-09-29 20:34:35

A Kerberos service ticket was requested (4769 "Security")

192.168.0.210
DC.socpedia.net
localadmin@SOCPEDIA.NET
Network Information: Client Address
::ffff:192.168.0.225
Account Information: Account Name
localadmin@SOCPEDIA.NET
Account Information: Account Domain
SOCPEDIA.NET
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Service Information: Service Name
DC$
Service Information: Service ID
S-1-5-21-1838030176-2987033226-1986555923-1000
Network Information: Client Address
::ffff:192.168.0.225
Network Information: Source Port
49152
Additional Information: Ticket Options
0x40800000
Additional Information: Ticket Encryption Type
0x12
Additional Information: Failure Code
0x0
Additional Information: Transited Services
-
Ticket information: Request ticket hash
+fNuCBxjLoDpilF2lQvjqChu2JfeqXkQ+ikNwjOJwpQ=
Ticket information: Response ticket hash
5kij2b/snygV88JUNxVV28mDA79eHuYZ3Lxdo+SmOno=
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3144
#146 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cec1
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
65534
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
5212
#147 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cec1
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
5212
#148 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cede
Account Information: Logon GUID
{478fa719-96b1-aaff-cdfe-cc3cf8c5a808}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49153
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#149 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
SP$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cede
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#150 2026-09-29 20:34:35

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\Windows\System32\config\netlogon.ftl
Creation UTC Time
2026-08-18 11:56:21.735
Image
C:\WINDOWS\system32\lsass.exe
Process GUID
{88ea2655-9ca8-6ab2-0c00-000000000700}
Process ID
876
Target Filename
C:\Windows\System32\config\netlogon.ftl
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.169
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#151 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cef4
Account Information: Logon GUID
{bd85057f-7674-3020-af7c-99dcbe5dcb2e}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49154
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3484
#152 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
SP$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cef4
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3484
#153 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cf0b
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#154 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cf0b
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49155
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#155 2026-09-29 20:34:35

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1240cf0b
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#156 2026-09-29 20:34:35

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
SP$
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1240cef4
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
5212
#157 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.502
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#158 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.504
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#159 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
Details
DWORD (0x00010002)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.505
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#160 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.505
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#161 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
Details
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.505
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#162 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
Details
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#163 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#164 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#165 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Control\Class\{c166523c-fe0c-4a94-a586-f1a80cfbbf3e}\0000\DriverVersion
Details
10.0.26100.1
Event Type
SetValue
Image
System
Process GUID
{88ea2655-9c98-6ab2-eb03-000000000000}
Process ID
4
Target Object
HKLM\System\CurrentControlSet\Control\Class\{c166523c-fe0c-4a94-a586-f1a80cfbbf3e}\0000\DriverVersion
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#166 2026-09-29 20:34:35

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1cb8
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\TSTheme.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#167 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Enum\SWD\MMDEVAPI\{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}\FriendlyName
Details
Remote Audio
Event Type
SetValue
Image
System
Process GUID
{88ea2655-9c98-6ab2-eb03-000000000000}
Process ID
4
Target Object
HKLM\System\CurrentControlSet\Enum\SWD\MMDEVAPI\{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}\FriendlyName
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.511
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#168 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Control\DeviceClasses\{e6327cad-dcec-4949-ae8a-991e976a79d2}\##?#SWD#MMDEVAPI#{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}#{e6327cad-dcec-4949-ae8a-991e976a79d2}\#\Device Parameters\FriendlyName
Details
Remote Audio
Event Type
SetValue
Image
C:\WINDOWS\System32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2f00-000000000700}
Process ID
2440
Target Object
HKLM\System\CurrentControlSet\Control\DeviceClasses\{e6327cad-dcec-4949-ae8a-991e976a79d2}\##?#SWD#MMDEVAPI#{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}#{e6327cad-dcec-4949-ae8a-991e976a79d2}\#\Device Parameters\FriendlyName
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.546
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#169 2026-09-29 20:34:35

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Image
C:\Windows\System32\TSTheme.exe
Process GUID
{88ea2655-da8b-6abb-be1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
TSThemeS.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=4B696349A9A2E131DF492390C3F86CCA826E90DA,SHA256=FDA3E9D3E468CCB7303085D77FD7B927EECEF4758AD8F6CC3E94AB9FB7B544EC,IMPHASH=DBA57ED5E1DD53B043DA5AD481675E39
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
7352
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#170 2026-09-29 20:34:35

A scheduled task was updated (4702 "Security")

192.168.0.225
SP.socpedia.net
SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task New Content
<?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <URI>\Microsoft\Windows\UpdateOrchestrator\Schedule Work</URI> <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)</SecurityDescriptor> </RegistrationInfo> <Triggers> <TimeTrigger> <StartBoundary>2026-09-30T02:38:27+05:00</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>S-1-5-18</UserId> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT1H</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>false</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>%systemroot%\system32\usoclient.exe</Command> <Arguments>StartWork</Arguments> </Exec> </Actions> </Task>
Other Information: ProcessCreationTime
1970324836974741
Other Information: ClientProcessId
3604
Other Information: ParentProcessId
2796
Other Information: RpcCallClientLocality
0
Other Information: FQDN
SP.socpedia.net
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#171 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Network Information: Source Network Address
-
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Information: Logon Type
5
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
Account Information: Logon GUID
{00000000-0000-0000-0000-000000000000}
Process Information: Process ID
0x364
Process Information: Process Name
C:\Windows\System32\services.exe
Network Information: Workstation Name
-
Network Information: Source Network Address
-
Network Information: Client Port
-
Detailed Authentication Information: Logon Process
Advapi
Detailed Authentication Information: Authentication Package
Negotiate
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#172 2026-09-29 20:34:35

Special privileges assigned to new logon (4672 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Subject: Security ID
S-1-5-18
Subject: Account Name
SYSTEM
Subject: Account Domain
NT AUTHORITY
Subject: Logon ID
0x3e7
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer
SP.socpedia.net
ProcessPID
876
IP
192.168.0.225
ThreadID
7792
#173 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
5
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#174 2026-09-29 20:34:35

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x1310
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#175 2026-09-29 20:34:35

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da8b-6abb-bf1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
4880
Parent Process ID
868
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#176 2026-09-29 20:34:35

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
rdpclip
Creator Subject: Security ID
S-1-5-20
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e4
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0xa30
Process Information: Creator Process ID
0x434
Process Information: New Process Name
C:\Windows\System32\rdpclip.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
rdpclip
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#177 2026-09-29 20:34:35

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
rdpclip
Command Line
rdpclip
Image
C:\Windows\System32\rdpclip.exe
Process GUID
{88ea2655-da8b-6abb-c01d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
rdpclip.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\System32\svchost.exe -k termsvcs -s TermService
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9caa-6ab2-1200-000000000700}
Parent User
NT AUTHORITY\NETWORK SERVICE
Hashes
SHA1=8AF528CFC7ADFE6CCD200F663B7A050DA56A7E21,SHA256=C40D77F4F722D495C78EBC17A12FAF389BC2F1ED8D5E1FBDC155C55A1B786FAF,IMPHASH=FBDEC6E4BA9A5126DECA850B0BC67149
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
2608
Parent Process ID
1076
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#178 2026-09-29 20:34:35

Remote Desktop Services: Session logon succeeded (21 "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Source Network Address
192.168.0.231
User
SOCPEDIA\localadmin
Session ID
7
Source Network Address
192.168.0.231
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
940
ThreadID
5048
#179 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x91c
Process Information: Creator Process ID
0xe14
Process Information: New Process Name
C:\Windows\UUS\amd64\MoNotificationUx.exe
Process Information: Creator Process Name
C:\Windows\UUS\amd64\MoUsoCoreWorker.exe
Process Information: Process Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#180 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Image
C:\Windows\UUS\amd64\MoNotificationUx.exe
Process GUID
{88ea2655-da8c-6abb-c11d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
MoNotificationUx.exe
User
SOCPEDIA\localadmin
Parent Command Line
"C:\WINDOWS\uus\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces
Parent Image
C:\Windows\UUS\amd64\MoUsoCoreWorker.exe
Parent Process GUID
{88ea2655-9d39-6ab2-9500-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=AC8F2BD147803AA6E52445CC314C628D96A33862,SHA256=C7FFC918E64B26D3B581BB8F23CDAED88F2DE0452DC6CF78155CCB27FA041343,IMPHASH=857CFF3FB2363C3A60D2046BA3EE1705
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
2332
Parent Process ID
3604
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#181 2026-09-29 20:34:36

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\Windows\Logs\waasmedic\waasmedic.20260929_153436_097.etl
Creation UTC Time
2026-09-29 15:34:36.097
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da8b-6abb-bf1d-000000000700}
Process ID
4880
Target Filename
C:\Windows\Logs\waasmedic\waasmedic.20260929_153436_097.etl
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:36.097
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#182 2026-09-29 20:34:36

An operation was attempted on a privileged object (4674 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process Information: Process Name
C:\Windows\System32\winlogon.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Object: Object Server
Security
Object: Object Type
-
Object: Object Name
-
Object: Object Handle
0x0
Requested Operation: Desired Access
0
Requested Operation: Privileges
SeTcbPrivilege
Process Information: Process ID
0x1714
Process Information: Process Name
C:\Windows\System32\winlogon.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#183 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
BluetoothUserService_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
BluetoothUserService_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k BthAppGroup -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#184 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CaptureService_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CaptureService_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k LocalService -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#185 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
cbdhsvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
cbdhsvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
2
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#186 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CDPUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CDPUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
2
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#187 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CloudBackupRestoreSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CloudBackupRestoreSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#188 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
ConsentUxUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
ConsentUxUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#189 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CredentialEnrollmentManagerUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CredentialEnrollmentManagerUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\CredentialEnrollmentManager.exe
Service Information: Service Type
0xd0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#190 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
DeviceAssociationBrokerSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
DeviceAssociationBrokerSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#191 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
DevicePickerUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
DevicePickerUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#192 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
DevicesFlowUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
DevicesFlowUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#193 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\Start
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\services.exe
Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID
868
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\Start
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:36.213
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#194 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\ImagePath
Details
C:\WINDOWS\system32\svchost.exe -k BthAppGroup -p
Event Type
SetValue
Image
C:\WINDOWS\system32\services.exe
Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID
868
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\ImagePath
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:36.213
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#195 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
NPSMSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
NPSMSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k LocalService -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#196 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
OneSyncSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
OneSyncSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
2
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#197 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
P9RdrService_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
P9RdrService_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k P9RdrService -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#198 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
PimIndexMaintenanceSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
PimIndexMaintenanceSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#199 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
sihost.exe
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1ae8
Process Information: Creator Process ID
0xacc
Process Information: New Process Name
C:\Windows\System32\sihost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
sihost.exe
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#200 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
PrintWorkflowUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
PrintWorkflowUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k PrintWorkflow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792

SOCpedia - платформа знаний

Здесь собраны материалы по практикам SOC и Blue Team: статьи, новости, книги и переводы.

Новости Блог Библиотека