Загрузка...
SOCpedia Logo SOCpedia
Таймлайны

Авторизация Kerberos

718 29.09.2026 20:50
  1. С рабочей станции ws2025.socpedia.net подключаемся по RDP к sp.socpedia.net под доменной учетной записью lacaladmin с неправильным паролем.
  2. С рабочей станции ws2025.socpedia.net подключаемся по RDP к sp.socpedia.net под доменной учетной записью lacaladmin с правильным паролем.

  3. На рабочей станции sp.socpedia.net выполняем SIgn out для учетной записи localadmin. 

    Жёлтым цветом выделены события, представляющие наибольший интерес для анализа активности.

Очистить фильтр
Найдено событий: 492 / Всего событий: 492
#401 2026-09-29 20:34:40

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210
DC.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Action Name
Feature Configuration Reconciliation Task Handler
Task Instance ID
{a51ba0b2-760b-4717-b370-4090163dd136}
Engine PID
6588
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
2372
ThreadID
6452
#402 2026-09-29 20:34:40

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210
DC.socpedia.net
NT AUTHORITY\SYSTEM
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
User Context
NT AUTHORITY\SYSTEM
Instance ID
{a51ba0b2-760b-4717-b370-4090163dd136}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
2372
ThreadID
6452
#403 2026-09-29 20:34:40

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{d062d9b1-2871-6aaa-2c00-000000000b00}
Process ID
2372
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:40.938
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
832
#404 2026-09-29 20:34:41

A privileged service was called (4673 "Security")

192.168.0.210
DC.socpedia.net
dc_admin
Process: Process Name
C:\Windows\System32\svchost.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x71bc577
Service: Server
Security
Service: Service Name
-
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x1b8
Process: Process Name
C:\Windows\System32\svchost.exe
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
3820
#405 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.210
DC.socpedia.net
DC$
Process Information: Process Command Line
"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
DC$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Target Subject: Account Name
dc_admin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0x71bc577
Process Information: New Process ID
0x1e0c
Process Information: Creator Process ID
0x1b8
Process Information: New Process Name
C:\Windows\System32\backgroundTaskHost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca
Process Information: Token Elevation Type
%%1938
Process Information: Mandatory Label
S-1-16-4096
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
7152
#406 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
SOCPEDIA\dc_admin
Command Line
"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca
Command Line
"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca
Image
C:\Windows\System32\backgroundTaskHost.exe
Process GUID
{d062d9b1-da91-6abb-002c-000000000b00}
Current Directory
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
Original File Name
backgroundTaskHost.exe
User
SOCPEDIA\dc_admin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{d062d9b1-286d-6aaa-0d00-000000000b00}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=422AE532BC5EE74B13EE0BE406A62C706B81F7EC,SHA256=B7D2C17E0038945AA4B72AE7A89E54D29B04CCC0FEB62DF5C9B7B67DE43C2530,IMPHASH=DC601E2593053A84A6989DE251407AA7
Logon GUID
{d062d9b1-a1d5-6ab2-77c5-1b0700000000}
Logon ID
0x71bc577
Integrity Level
AppContainer
Process ID
7692
Parent Process ID
440
Terminal Session ID
2
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
832
#407 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1814
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\dllhost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7640
#408 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Image
C:\Windows\System32\dllhost.exe
Process GUID
{88ea2655-da91-6abb-cf1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
dllhost.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=F401AE9310FAB4781A3E9FA1EAFF26F3D484C6E0,SHA256=50C9C2EDEA6C51F1AAD2DD80A59F4EDB32637F51714F8472D216E5B9BDACDABF,IMPHASH=FBDAC0471446783AD621D3CAB6033559
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
6164
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#409 2026-09-29 20:34:41

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process: Process Name
C:\Windows\System32\svchost.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Service: Server
Security
Service: Service Name
-
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x3e8
Process: Process Name
C:\Windows\System32\svchost.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7640
#410 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1fa8
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-4096
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7640
#411 2026-09-29 20:34:41

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process: Process Name
C:\Windows\System32\svchost.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Service: Server
Security
Service: Service Name
-
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x3e8
Process: Process Name
C:\Windows\System32\svchost.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#412 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x2244
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-4096
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#413 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
Command Line
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Current Directory
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
Original File Name
SearchHost.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=5B675FC608364E49FEA93C3086460BEA1D261E42,SHA256=20BEF4D59D8E5D198CB2FCACDD46721D100773E43CA2D7D5C62515B60CA1D570,IMPHASH=1CD8B57E28B6803311249B05E4E54FDE
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
AppContainer
Process ID
8104
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#414 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Command Line
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Image
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Process GUID
{88ea2655-da91-6abb-d11d-000000000700}
Current Directory
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\
Original File Name
startmenuexperiencehost.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=27E5D925410DD26929806A8600248D9366F8C80E,SHA256=B5E184B0B602E3C2C5E58816059AF0C2019AD8F72EE9142ACC26FA567312D3E3,IMPHASH=350F16B9C0052E44E6D5614DC9750D8F
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
AppContainer
Process ID
8772
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#415 2026-09-29 20:34:42

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\System32\TSTheme.exe
Image
C:\Windows\System32\TSTheme.exe
Process GUID
{88ea2655-da8b-6abb-be1d-000000000700}
Process ID
7352
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:42.031
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#416 2026-09-29 20:34:42

Action success (201 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210
DC.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task Instance ID
{a51ba0b2-760b-4717-b370-4090163dd136}
Action Name
Feature Configuration Reconciliation Task Handler
Result Code
0
Engine PID
6588
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
2372
ThreadID
8264
#417 2026-09-29 20:34:42

Task success event (102 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210
DC.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
User Context
NT AUTHORITY\SYSTEM
Instance ID
{a51ba0b2-760b-4717-b370-4090163dd136}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
2372
ThreadID
8264
#418 2026-09-29 20:34:42

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{d062d9b1-2871-6aaa-2c00-000000000b00}
Process ID
2372
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:42.500
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
832
#419 2026-09-29 20:34:42

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
NT AUTHORITY\SYSTEM
Image
C:\Windows\System32\taskhostw.exe
Image
C:\Windows\System32\taskhostw.exe
Process GUID
{d062d9b1-da90-6abb-ff2b-000000000b00}
Process ID
6588
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:42.510
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
832
#420 2026-09-29 20:34:42

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0xd58
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\RuntimeBroker.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#421 2026-09-29 20:34:42

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Image
C:\Windows\System32\RuntimeBroker.exe
Process GUID
{88ea2655-da92-6abb-d21d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
RuntimeBroker.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=A7B9BC796908A33505B6F65D27D414D72E420B56,SHA256=182FF5D6271D67916B0D6B3F734A5EB02542F9FEE853D6C687807D20152B2E78,IMPHASH=DD3379331F906897D3533DB83F199654
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
3416
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#422 2026-09-29 20:34:42

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x7f4
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\RuntimeBroker.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7640
#423 2026-09-29 20:34:42

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Image
C:\Windows\System32\RuntimeBroker.exe
Process GUID
{88ea2655-da92-6abb-d31d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
RuntimeBroker.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=A7B9BC796908A33505B6F65D27D414D72E420B56,SHA256=182FF5D6271D67916B0D6B3F734A5EB02542F9FEE853D6C687807D20152B2E78,IMPHASH=DD3379331F906897D3533DB83F199654
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
2036
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#424 2026-09-29 20:34:43

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1b30
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#425 2026-09-29 20:34:43

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
Command Line
C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da93-6abb-d41d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
6960
Parent Process ID
868
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#426 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
UTC Time
2026-09-29 15:34:43.167
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Process ID
8104
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device
\Device\HarddiskVolume1
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#427 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
UTC Time
2026-09-29 15:34:43.169
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Process ID
8104
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device
\Device\HarddiskVolume1
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#428 2026-09-29 20:34:43

The service entered the stopped state (7036 "System")

192.168.0.225
SP.socpedia.net
param1
Udk User Service_a1cd52d
Binary
550064006B0055007300650072005300760063005F0061003100630064003500320064002F0034000000
param1
Udk User Service_a1cd52d
param2
running
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
868
ThreadID
2324
#429 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
UTC Time
2026-09-29 15:34:43.404
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Process ID
8104
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device
\Device\HarddiskVolume1
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#430 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
UTC Time
2026-09-29 15:34:43.404
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Process ID
8104
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device
\Device\HarddiskVolume1
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#431 2026-09-29 20:34:43

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.225
SP.socpedia.net
Calling Process Name
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#432 2026-09-29 20:34:43

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.225
SP.socpedia.net
Calling Process Name
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#433 2026-09-29 20:34:43

The SMB redirector selected the connection initiated with the following parameters (30830 "Microsoft-Windows-SmbClient/Connectivity")

192.168.0.225
SP.socpedia.net
Server name
DC.socpedia.net
Server name
DC.socpedia.net
Connection Type
1
Remote Address
020001BDC0A800D20000000000000000
Instance Name
\Device\LanmanRedirector
Port Origin
4
Error Code
0x0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
708
ThreadID
8724
#434 2026-09-29 20:34:43

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1840
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x12414826
Account Information: Logon GUID
{e565aef3-4045-e464-d379-914fc8beb8f7}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49159
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#435 2026-09-29 20:34:43

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
SP$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x12414826
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#436 2026-09-29 20:34:43

A network share object was accessed (5140 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x12414826
Network Information: Object Type
File
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49159
Share Information: Share Name
\\*\IPC$
Access Request Information: Access Mask
0x1
Access Request Information: Accesses
%%4416
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
7248
#437 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
UTC Time
2026-09-29 15:34:43.865
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Process ID
8104
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device
\Device\HarddiskVolume1
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#438 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
UTC Time
2026-09-29 15:34:43.865
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Process ID
8104
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device
\Device\HarddiskVolume1
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#439 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7keyboard0\DriverVerVersion
Details
10.0.26100.1150
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID
4100
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7keyboard0\DriverVerVersion
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:44.050
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#440 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7mouse0\DriverVerVersion
Details
10.0.26100.1
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID
4100
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7mouse0\DriverVerVersion
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:44.064
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#441 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\swd/remotedisplayenum/rdpidd_indirectdisplay&sessionid_0007\DriverVerVersion
Details
10.0.26100.1150
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID
4100
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\swd/remotedisplayenum/rdpidd_indirectdisplay&sessionid_0007\DriverVerVersion
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:44.076
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#442 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\display/default_monitor/1&5771b5a&0&uid256\DriverVerVersion
Details
10.0.26100.1150
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID
4100
Target Object
\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\display/default_monitor/1&5771b5a&0&uid256\DriverVerVersion
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:44.088
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#443 2026-09-29 20:34:44

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process: Process Name
C:\Windows\System32\RuntimeBroker.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Service: Server
Security
Service: Service Name
-
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0xd58
Process: Process Name
C:\Windows\System32\RuntimeBroker.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4376
#444 2026-09-29 20:34:45

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
/QuitInfo:0000000000000258;000000000000023C;
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0xbfc
Process Information: Creator Process ID
0xb78
Process Information: New Process Name
C:\Windows\System32\ctfmon.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
/QuitInfo:0000000000000258;000000000000023C;
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8208
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
836
#445 2026-09-29 20:34:45

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
/QuitInfo:0000000000000258;000000000000023C;
Command Line
/QuitInfo:0000000000000258;000000000000023C;
Image
C:\Windows\System32\ctfmon.exe
Process GUID
{88ea2655-da95-6abb-d51d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
CTFMON.EXE
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9cad-6ab2-3800-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=1B3F7B8416C54DA13A51086D7C49412983720B33,SHA256=6DB24A587D68F47705F6BFC5DE76BE716E6A1437C20EB55ACCF2D2ACCDF2A400,IMPHASH=B539389D4BE1DD68C8213A539FEB41FB
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
3068
Parent Process ID
2936
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#446 2026-09-29 20:34:45

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
false
Process GUID
{d062d9b1-285a-6aaa-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49159
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:35:44.140
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
4552
#447 2026-09-29 20:34:45

An account was successfully logged on (4624 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Network Information: Source Network Address
-
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Information: Logon Type
5
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
Account Information: Logon GUID
{00000000-0000-0000-0000-000000000000}
Process Information: Process ID
0x364
Process Information: Process Name
C:\Windows\System32\services.exe
Network Information: Workstation Name
-
Network Information: Source Network Address
-
Network Information: Client Port
-
Detailed Authentication Information: Logon Process
Advapi
Detailed Authentication Information: Authentication Package
Negotiate
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#448 2026-09-29 20:34:45

Special privileges assigned to new logon (4672 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Subject: Security ID
S-1-5-18
Subject: Account Name
SYSTEM
Subject: Account Domain
NT AUTHORITY
Subject: Logon ID
0x3e7
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer
SP.socpedia.net
ProcessPID
876
IP
192.168.0.225
ThreadID
740
#449 2026-09-29 20:34:45

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
5
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#450 2026-09-29 20:34:45

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0xfcc
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#451 2026-09-29 20:34:45

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc
Command Line
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da95-6abb-d61d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
4044
Parent Process ID
868
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#452 2026-09-29 20:34:45

The service entered the stopped state (7036 "System")

192.168.0.225
SP.socpedia.net
param1
Windows Insider Service
Binary
770069007300760063002F0034000000
param1
Windows Insider Service
param2
running
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
868
ThreadID
8424
#453 2026-09-29 20:34:45

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
445
DestinationPortName
microsoft-ds
Image
System
Initiated
true
Process GUID
{88ea2655-9c98-6ab2-eb03-000000000000}
Process ID
4
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
SP.socpedia.net
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49159
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:35:42.281
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4272
#454 2026-09-29 20:34:45

File creation time changed (2 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Target Filename
C:\Users\localadmin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
UTC Time
2026-09-29 15:34:45.798
Process GUID
{88ea2655-da91-6abb-d11d-000000000700}
Process ID
8772
Image
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Target Filename
C:\Users\localadmin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
Creation UTC Time
2026-09-28 16:29:34.178
Previous Creation UTC Time
2026-09-29 15:34:45.664
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#455 2026-09-29 20:34:46

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process: Process Name
C:\Windows\System32\svchost.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Service: Server
Security
Service: Service Name
-
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x3e8
Process: Process Name
C:\Windows\System32\svchost.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
9024
#456 2026-09-29 20:34:46

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
"C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1fbc
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\backgroundTaskHost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
"C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-4096
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
9024
#457 2026-09-29 20:34:46

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
"C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
Command Line
"C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
Image
C:\Windows\System32\backgroundTaskHost.exe
Process GUID
{88ea2655-da96-6abb-d71d-000000000700}
Current Directory
C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\
Original File Name
backgroundTaskHost.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=422AE532BC5EE74B13EE0BE406A62C706B81F7EC,SHA256=B7D2C17E0038945AA4B72AE7A89E54D29B04CCC0FEB62DF5C9B7B67DE43C2530,IMPHASH=DC601E2593053A84A6989DE251407AA7
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
AppContainer
Process ID
8124
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#458 2026-09-29 20:34:46

File creation time changed (2 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Target Filename
C:\Users\localadmin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
UTC Time
2026-09-29 15:34:46.367
Process GUID
{88ea2655-da91-6abb-d01d-000000000700}
Process ID
8104
Image
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Target Filename
C:\Users\localadmin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
Creation UTC Time
2026-09-28 16:29:35.179
Previous Creation UTC Time
2026-09-29 15:34:46.322
User
SOCPEDIA\localadmin
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#459 2026-09-29 20:34:46

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x2204
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\RuntimeBroker.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4376
#460 2026-09-29 20:34:46

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Command Line
C:\Windows\System32\RuntimeBroker.exe -Embedding
Image
C:\Windows\System32\RuntimeBroker.exe
Process GUID
{88ea2655-da96-6abb-d81d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
RuntimeBroker.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=A7B9BC796908A33505B6F65D27D414D72E420B56,SHA256=182FF5D6271D67916B0D6B3F734A5EB02542F9FEE853D6C687807D20152B2E78,IMPHASH=DD3379331F906897D3533DB83F199654
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
8708
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#461 2026-09-29 20:34:46

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x12414895
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49162
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#462 2026-09-29 20:34:46

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x12414895
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#463 2026-09-29 20:34:46

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x124148b0
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49163
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#464 2026-09-29 20:34:46

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x124148b0
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#465 2026-09-29 20:34:46

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x124148c4
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49164
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#466 2026-09-29 20:34:46

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x124148c4
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#467 2026-09-29 20:34:46

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x124148c4
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#468 2026-09-29 20:34:46

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x124148b0
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#469 2026-09-29 20:34:46

DNS query (22 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Query Name
DC.socpedia.net
Image
C:\Windows\System32\backgroundTaskHost.exe
Process GUID
{88ea2655-da96-6abb-d71d-000000000700}
Process ID
8124
Query Name
DC.socpedia.net
Query Results
::ffff:192.168.0.210;
Query Status
0
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:46.716
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
5236
#470 2026-09-29 20:34:47

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\System32\dllhost.exe
Image
C:\Windows\System32\dllhost.exe
Process GUID
{88ea2655-da91-6abb-cf1d-000000000700}
Process ID
6164
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:47.154
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#471 2026-09-29 20:34:47

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
DestinationIp
52.110.17.59
DestinationHostname
-
DestinationIp
52.110.17.59
DestinationIsIpv6
false
DestinationPort
443
DestinationPortName
https
Image
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Initiated
true
Process GUID
{88ea2655-da91-6abb-d11d-000000000700}
Process ID
8772
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
SP.socpedia.net
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49160
SourcePortName
-
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:35:44.558
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4272
#472 2026-09-29 20:34:47

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
49684
DestinationPortName
-
Image
C:\Windows\System32\lsass.exe
Initiated
false
Process GUID
{d062d9b1-2863-6aaa-0c00-000000000b00}
Process ID
844
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49162
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:35:47.034
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
4552
#473 2026-09-29 20:34:47

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC.socpedia.net
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
135
DestinationPortName
epmap
Image
C:\Windows\System32\svchost.exe
Initiated
false
Process GUID
{d062d9b1-286e-6aaa-0e00-000000000b00}
Process ID
988
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
-
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49161
SourcePortName
-
User
NT AUTHORITY\NETWORK SERVICE
UTC Time
2026-09-29 15:35:47.024
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
4552
#474 2026-09-29 20:34:48

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\System32\mobsync.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1508
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\mobsync.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\WINDOWS\System32\mobsync.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
9024
#475 2026-09-29 20:34:48

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\System32\backgroundTaskHost.exe
Image
C:\Windows\System32\backgroundTaskHost.exe
Process GUID
{88ea2655-da96-6abb-d71d-000000000700}
Process ID
8124
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:48.006
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#476 2026-09-29 20:34:48

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\System32\mobsync.exe -Embedding
Command Line
C:\WINDOWS\System32\mobsync.exe -Embedding
Image
C:\Windows\System32\mobsync.exe
Process GUID
{88ea2655-da98-6abb-d91d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
mobsync.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=B67DABA43D37829B39D5F5D39E13F53771466205,SHA256=DC95D8C153AD3B004819BC9F18C3F5BB98B70CF8B243EA32736C895A9A370A69,IMPHASH=0303D470D1699A284C1DC4CCDF502016
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
5384
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#477 2026-09-29 20:34:48

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x12414895
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#478 2026-09-29 20:34:48

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
SP$
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1240cede
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#479 2026-09-29 20:34:48

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
135
DestinationPortName
epmap
Image
<unknown process>
Initiated
true
Process GUID
{00000000-0000-0000-0000-000000000000}
Process ID
8124
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
SP.socpedia.net
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49161
SourcePortName
-
User
-
UTC Time
2026-09-29 15:35:45.165
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4272
#480 2026-09-29 20:34:48

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
DestinationIp
52.110.17.62
DestinationHostname
-
DestinationIp
52.110.17.62
DestinationIsIpv6
false
DestinationPort
443
DestinationPortName
https
Image
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Initiated
true
Process GUID
{88ea2655-da91-6abb-d11d-000000000700}
Process ID
8772
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
SP.socpedia.net
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49165
SourcePortName
-
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:35:45.347
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4272
#481 2026-09-29 20:34:49

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\System32\rundll32.exe
Image
C:\Windows\System32\rundll32.exe
Process GUID
{88ea2655-da8f-6abb-ce1d-000000000700}
Process ID
8848
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:49.365
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#482 2026-09-29 20:34:49

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
DestinationIp
192.168.0.210
DestinationHostname
DC
DestinationIp
192.168.0.210
DestinationIsIpv6
false
DestinationPort
49684
DestinationPortName
-
Image
<unknown process>
Initiated
true
Process GUID
{00000000-0000-0000-0000-000000000000}
Process ID
8124
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
SP.socpedia.net
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49162
SourcePortName
-
User
-
UTC Time
2026-09-29 15:35:45.175
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4272
#483 2026-09-29 20:34:49

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
DestinationIp
40.126.35.151
DestinationHostname
-
DestinationIp
40.126.35.151
DestinationIsIpv6
false
DestinationPort
443
DestinationPortName
https
Image
<unknown process>
Initiated
true
Process GUID
{00000000-0000-0000-0000-000000000000}
Process ID
8124
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
SP.socpedia.net
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49166
SourcePortName
-
User
-
UTC Time
2026-09-29 15:35:45.664
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4272
#484 2026-09-29 20:34:49

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\Windows\System32\smartscreen.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x128c
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\smartscreen.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\Windows\System32\smartscreen.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#485 2026-09-29 20:34:49

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\Windows\System32\smartscreen.exe -Embedding
Command Line
C:\Windows\System32\smartscreen.exe -Embedding
Image
C:\Windows\System32\smartscreen.exe
Process GUID
{88ea2655-da99-6abb-da1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
smartscreen.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=625D5080A3972689A71B8024B8499FDBBF80DC7C,SHA256=3FBFE0A811CB59312EF7597EE0F4FEC6EF1576F5FF0828A7F79FA5C30FC20305,IMPHASH=460054574AFB80F85A81443C12C1A3D8
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
4748
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#486 2026-09-29 20:34:49

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process Information: Process Command Line
"C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"
Creator Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Creator Subject: Account Name
localadmin
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0xa1beca3
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x2224
Process Information: Creator Process ID
0x23e4
Process Information: New Process Name
C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Process Information: Creator Process Name
C:\Windows\explorer.exe
Process Information: Process Command Line
"C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4376
#487 2026-09-29 20:34:49

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
"C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"
Command Line
"C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"
Image
C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Process GUID
{88ea2655-da99-6abb-db1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
-
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\Explorer.EXE
Parent Image
C:\Windows\explorer.exe
Parent Process GUID
{88ea2655-da8d-6abb-cb1d-000000000700}
Parent User
SOCPEDIA\localadmin
Hashes
SHA1=8FCE93EA0FD1D2EA9833D3AA86E4BEBD39A502A7,SHA256=CC4B21143E027F7623BF3F01F49C4E774F42987FD74C5D7E0B8B160EAC6C8991,IMPHASH=3077DAB08EA098FD564AF382CAE8B6E9
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
8740
Parent Process ID
9188
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#488 2026-09-29 20:34:49

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process: Process Name
C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Service: Server
Security
Service: Service Name
-
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x2224
Process: Process Name
C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
3116
#489 2026-09-29 20:34:49

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Image
C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Process GUID
{88ea2655-da99-6abb-db1d-000000000700}
Process ID
8740
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:49.761
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#490 2026-09-29 20:34:49

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x21bc
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\dllhost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
3116
#491 2026-09-29 20:34:49

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Command Line
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Image
C:\Windows\System32\dllhost.exe
Process GUID
{88ea2655-da99-6abb-dc1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
dllhost.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=F401AE9310FAB4781A3E9FA1EAFF26F3D484C6E0,SHA256=50C9C2EDEA6C51F1AAD2DD80A59F4EDB32637F51714F8472D216E5B9BDACDABF,IMPHASH=FBDAC0471446783AD621D3CAB6033559
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
8636
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#492 2026-09-29 20:34:50

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process Information: Process Command Line
"C:\Windows\System32\SecurityHealthSystray.exe"
Creator Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Creator Subject: Account Name
localadmin
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0xa1beca3
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0xa54
Process Information: Creator Process ID
0x23e4
Process Information: New Process Name
C:\Windows\System32\SecurityHealthSystray.exe
Process Information: Creator Process Name
C:\Windows\explorer.exe
Process Information: Process Command Line
"C:\Windows\System32\SecurityHealthSystray.exe"
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160

SOCpedia - платформа знаний

Здесь собраны материалы по практикам SOC и Blue Team: статьи, новости, книги и переводы.

Новости Блог Библиотека