{ "schema": "portfolio.ad-investigation.v1", "source_commit": "d9d40ef123d2c87d5d3df28c96bcab4f0faccc87", "source_page": "https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201022042947.html", "scope": "Independent analysis of OTRF recorded emulation telemetry; not a production incident or owner-operated attack lab.", "archives": [ { "kind": "host", "url": "https://raw.githubusercontent.com/OTRF/Security-Datasets/d9d40ef123d2c87d5d3df28c96bcab4f0faccc87/datasets/atomic/windows/lateral_movement/host/purplesharp_ad_playbook_I.zip", "sha256": "2a2d80e7b8d8ee6821a1754118f3ab908b4bac84cf4ed3d018e281f631bd2870", "member": "purplesharp_ad_playbook_I_2020-10-22042947.json", "member_sha256": "d86d22f0c02ab851564bb5e0c90c220e9df0319f5948bfc90dfa605b4511d4f0" }, { "kind": "network", "url": "https://raw.githubusercontent.com/OTRF/Security-Datasets/d9d40ef123d2c87d5d3df28c96bcab4f0faccc87/datasets/atomic/windows/lateral_movement/network/purplesharp_ad_playbook_I.zip", "sha256": "c7dd67e1f2b914d4f553b3ef98d29b8858ed86b03ffa7dd7c0a55af30eacf03b", "member": "purplesharp_ad_playbook_I_2020-10-22042947.cap", "member_sha256": "999f071e499361b92356adce807d4c6ed6721ae60bb59f8f181b16bfbc80ac45" } ], "clock_policy": { "offset": "-04:00", "status": "inferred capture-local offset; not a geographic timezone claim", "calibration": [ { "host": "WORKSTATION5.theshire.local", "line": 19, "difference_seconds": 0.016 }, { "host": "MORDORDC.theshire.local", "line": 272, "difference_seconds": 0.03 }, { "host": "WORKSTATION5.theshire.local", "line": 642, "difference_seconds": 0.964 }, { "host": "WORKSTATION5.theshire.local", "line": 771, "difference_seconds": 0.024 }, { "host": "WORKSTATION7.theshire.local", "line": 2603, "difference_seconds": 0.284 }, { "host": "WORKSTATION7.theshire.local", "line": 2694, "difference_seconds": 0.452 }, { "host": "WORKSTATION6.theshire.local", "line": 2870, "difference_seconds": 0.873 }, { "host": "WORKSTATION7.theshire.local", "line": 2893, "difference_seconds": 0.574 }, { "host": "WORKSTATION6.theshire.local", "line": 3139, "difference_seconds": 0.026 }, { "host": "WORKSTATION6.theshire.local", "line": 3275, "difference_seconds": 0.134 }, { "host": "WORKSTATION6.theshire.local", "line": 3601, "difference_seconds": 0.518 }, { "host": "WORKSTATION7.theshire.local", "line": 3833, "difference_seconds": 0.013 }, { "host": "WORKSTATION7.theshire.local", "line": 4352, "difference_seconds": 0.036 }, { "host": "WORKSTATION6.theshire.local", "line": 4447, "difference_seconds": 0.967 }, { "host": "WORKSTATION7.theshire.local", "line": 5179, "difference_seconds": 0.21 }, { "host": "WORKSTATION6.theshire.local", "line": 5406, "difference_seconds": 0.601 }, { "host": "MORDORDC.theshire.local", "line": 7306, "difference_seconds": 0.94 }, { "host": "WORKSTATION7.theshire.local", "line": 10560, "difference_seconds": 0.017 }, { "host": "WORKSTATION6.theshire.local", "line": 10786, "difference_seconds": 0.461 }, { "host": "MORDORDC.theshire.local", "line": 23271, "difference_seconds": 0.183 }, { "host": "MORDORDC.theshire.local", "line": 23781, "difference_seconds": 0.653 }, { "host": "MORDORDC.theshire.local", "line": 23911, "difference_seconds": 0.802 }, { "host": "MORDORDC.theshire.local", "line": 24051, "difference_seconds": 0.095 }, { "host": "MORDORDC.theshire.local", "line": 24058, "difference_seconds": 0.113 } ], "ingestion_is_event_time": false }, "coverage": { "host_events": 25993, "hosts": { "MORDORDC.theshire.local": 19875, "WORKSTATION5.theshire.local": 769, "WORKSTATION6.theshire.local": 2677, "WORKSTATION7.theshire.local": 2672 }, "providers": { "Microsoft-Windows-Hyper-V-Netvsc": 2, "Microsoft-Windows-PowerShell": 747, "Microsoft-Windows-Security-Auditing": 2843, "Microsoft-Windows-Sysmon": 22054, "Microsoft-Windows-WMI-Activity": 4, "PowerShell": 342, "Service Control Manager": 1 }, "selected_host_records": 226, "duplicate_selected_records": 0, "pcap_records": 1121, "decoded_transport_records": 1048, "packet_exclusions": { "truncated_ipv4": 61, "unsupported_transport": 12 } }, "records": [ { "id": "H01527", "line": 1527, "raw_sha256": "f947e893a5d1477d951bf36c094a3663b35b8d8523dbd53f8d5180e6a5a81e72", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388222, "epoch": 1603355392.005, "event_time": "2020-10-22T08:29:52.005Z", "collection_time": "2020-10-22T08:29:55.710Z", "delay_seconds": 3.705, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 51883, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.710Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.005", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388222, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "51883", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "udp", "Initiated": "true" } }, { "id": "H00019", "line": 19, "raw_sha256": "7adba34c5f6d4a97b0c9e9aa046e2d57ef317aedbe16ca5593a72bced1e6df54", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388000, "epoch": 1603355392.016, "event_time": "2020-10-22T08:29:52.016Z", "collection_time": "2020-10-22T08:29:53.801Z", "delay_seconds": 1.785, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": "0x9cc0b6", "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "{313fa531-42ab-5f91-aa04-000000000400}", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "C:\\Windows\\System32\\cmd.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:53.801Z", "EventTime": "2020-10-22 04:29:52", "EventReceivedTime": "2020-10-22 04:29:53", "UtcTime": "2020-10-22 08:29:52.016", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388000, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "CommandLine": "PurpleSharp.exe /t T1110.003,T1558.003,T1135,T1021.006", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "ParentProcessGuid": "{313fa531-42ab-5f91-aa04-000000000400}", "ParentImage": "C:\\Windows\\System32\\cmd.exe", "ParentProcessId": "5776", "LogonId": "0x9cc0b6" } }, { "id": "H01559", "line": 1559, "raw_sha256": "7cf022467089120108370858c4ec450eb308b08022702d55ca04d50696109a1f", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388228, "epoch": 1603355392.114, "event_time": "2020-10-22T08:29:52.114Z", "collection_time": "2020-10-22T08:29:55.737Z", "delay_seconds": 3.623, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58178, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.737Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.114", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388228, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58178", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H01563", "line": 1563, "raw_sha256": "05112d9136acf517eb4128fbf67873f1c0dd1029f7409c340b59634dd8133c73", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388229, "epoch": 1603355392.183, "event_time": "2020-10-22T08:29:52.183Z", "collection_time": "2020-10-22T08:29:55.739Z", "delay_seconds": 3.556, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58179, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.739Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.183", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388229, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58179", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H01585", "line": 1585, "raw_sha256": "3ac5b1922f1aaf51707c7f9df9674ce509e33ce0ac15e398c8a9c0ea0557a78d", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388230, "epoch": 1603355392.21, "event_time": "2020-10-22T08:29:52.210Z", "collection_time": "2020-10-22T08:29:55.751Z", "delay_seconds": 3.541, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58180, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.751Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.210", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388230, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58180", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H01589", "line": 1589, "raw_sha256": "a74f352e7181a209b8047f07a7c574d698ab85120235a08c2b53c4b449bb6497", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388231, "epoch": 1603355392.32, "event_time": "2020-10-22T08:29:52.320Z", "collection_time": "2020-10-22T08:29:55.755Z", "delay_seconds": 3.435, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58181, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.755Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.320", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388231, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58181", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H01595", "line": 1595, "raw_sha256": "440ad6b82fe69ae103c86576a09789f30f669820ef8479403d3e876c3bc2c966", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388232, "epoch": 1603355392.34, "event_time": "2020-10-22T08:29:52.340Z", "collection_time": "2020-10-22T08:29:55.759Z", "delay_seconds": 3.419, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58182, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.759Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.340", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388232, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58182", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H06448", "line": 6448, "raw_sha256": "922042dc5f60e5721079d7572bedb0f8fb569ea9098b2bdd245527160c336145", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732242, "epoch": 1603355392.475, "event_time": "2020-10-22T08:29:52.475Z", "collection_time": "2020-10-22T08:30:07.111Z", "delay_seconds": 14.636, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.5", "source_port": 389, "destination_port": 51883, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.111Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.475", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732242, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "389", "DestinationIp": "172.18.39.5", "DestinationPort": "51883", "Protocol": "udp", "Initiated": "false" } }, { "id": "H01633", "line": 1633, "raw_sha256": "b062255b91a88ffd25ed30acdf3a10bab22fde48354a5525154cd53c47320a0a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388240, "epoch": 1603355392.536, "event_time": "2020-10-22T08:29:52.536Z", "collection_time": "2020-10-22T08:29:55.784Z", "delay_seconds": 3.248, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58183, "destination_port": 135, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.784Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.536", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388240, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58183", "DestinationIp": "172.18.38.5", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H01638", "line": 1638, "raw_sha256": "422a584886ff57f939b6c02bfcfd82e66de2fa9e9fd14194b7993c7885c5f083", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388241, "epoch": 1603355392.539, "event_time": "2020-10-22T08:29:52.539Z", "collection_time": "2020-10-22T08:29:55.787Z", "delay_seconds": 3.248, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58184, "destination_port": 49674, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.787Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:52.539", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388241, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58184", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H06452", "line": 6452, "raw_sha256": "004067e1182c7ea66e4ca2a3c2182d7564c6d2a18adb26a927196533163574f0", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732243, "epoch": 1603355392.584, "event_time": "2020-10-22T08:29:52.584Z", "collection_time": "2020-10-22T08:30:07.111Z", "delay_seconds": 14.527, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58178, "destination_port": 389, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.111Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.584", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732243, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58178", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H06456", "line": 6456, "raw_sha256": "cdb17b940f4568205dafc1417810070b9c58433ab573cbee04b6955e06ebfd5a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732244, "epoch": 1603355392.653, "event_time": "2020-10-22T08:29:52.653Z", "collection_time": "2020-10-22T08:30:07.111Z", "delay_seconds": 14.458, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58179, "destination_port": 389, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.111Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.653", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732244, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58179", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H06466", "line": 6466, "raw_sha256": "78c588ad9307c4989aff548b8c8ec012c49abadbc20e0ec2bcbc7f944d30543d", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732245, "epoch": 1603355392.68, "event_time": "2020-10-22T08:29:52.680Z", "collection_time": "2020-10-22T08:30:07.112Z", "delay_seconds": 14.432, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58180, "destination_port": 389, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.112Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.680", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732245, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58180", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H06956", "line": 6956, "raw_sha256": "66262cd690a4a19ea4c892b2de7dc43a21d749b85b81b6a7b38cdb376b2cc7df", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732409, "epoch": 1603355392.79, "event_time": "2020-10-22T08:29:52.790Z", "collection_time": "2020-10-22T08:30:07.386Z", "delay_seconds": 14.596, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58181, "destination_port": 389, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.386Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.790", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732409, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58181", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H06958", "line": 6958, "raw_sha256": "050cc6f9b8c09e9c913ac8b7989bcc4e0f777f6e79597c08021664046d50579e", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732410, "epoch": 1603355392.804, "event_time": "2020-10-22T08:29:52.804Z", "collection_time": "2020-10-22T08:30:07.386Z", "delay_seconds": 14.582, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3512, "session": null, "guid": "{fddc55f3-b938-5f8f-5100-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\dns.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.5", "source_port": 53, "destination_port": 62908, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.386Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.804", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732410, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dns.exe", "ProcessId": "3512", "ProcessGuid": "{fddc55f3-b938-5f8f-5100-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "53", "DestinationIp": "172.18.39.5", "DestinationPort": "62908", "Protocol": "udp", "Initiated": "false" } }, { "id": "H06960", "line": 6960, "raw_sha256": "ffd733981c46fce74f85eaea01b0c9d02d22fff50728d3d6c20f5aecafd623a5", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732411, "epoch": 1603355392.805, "event_time": "2020-10-22T08:29:52.805Z", "collection_time": "2020-10-22T08:30:07.386Z", "delay_seconds": 14.581, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3512, "session": null, "guid": "{fddc55f3-b938-5f8f-5100-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\dns.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.5", "source_port": 53, "destination_port": 54451, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.386Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.805", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732411, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dns.exe", "ProcessId": "3512", "ProcessGuid": "{fddc55f3-b938-5f8f-5100-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "53", "DestinationIp": "172.18.39.5", "DestinationPort": "54451", "Protocol": "udp", "Initiated": "false" } }, { "id": "H06962", "line": 6962, "raw_sha256": "40103dcdecc344040db0f906624d4034b615ca2a64a97c2edfbcd63af3354139", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732412, "epoch": 1603355392.81, "event_time": "2020-10-22T08:29:52.810Z", "collection_time": "2020-10-22T08:30:07.386Z", "delay_seconds": 14.576, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58182, "destination_port": 389, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.386Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.810", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732412, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58182", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02110", "line": 2110, "raw_sha256": "0d3bae9882a132b3aa098ae2d7917bd5089662265f79b61ac68b97afd170cb3e", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388255, "epoch": 1603355392.858, "event_time": "2020-10-22T08:29:52.858Z", "collection_time": "2020-10-22T08:29:57.047Z", "delay_seconds": 4.189, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58185, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.047Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:52.858", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388255, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58185", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02111", "line": 2111, "raw_sha256": "9fd757f80fb6e316956da4fc90ad218d312aa5f905e05aa974d37ec126a269d3", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388256, "epoch": 1603355392.891, "event_time": "2020-10-22T08:29:52.891Z", "collection_time": "2020-10-22T08:29:57.047Z", "delay_seconds": 4.156, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58186, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.047Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:52.891", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388256, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58186", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02112", "line": 2112, "raw_sha256": "396514764fc8a01221464d029f4341325a1de91fef501ea68ba734f2af3c6935", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388257, "epoch": 1603355392.895, "event_time": "2020-10-22T08:29:52.895Z", "collection_time": "2020-10-22T08:29:57.048Z", "delay_seconds": 4.153, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58187, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.048Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:52.895", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388257, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58187", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02113", "line": 2113, "raw_sha256": "a524242fb7100417f798d5f4beb2382384f68a25fbfa07db7eb97206bbcbb8de", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388258, "epoch": 1603355392.899, "event_time": "2020-10-22T08:29:52.899Z", "collection_time": "2020-10-22T08:29:57.048Z", "delay_seconds": 4.149, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58188, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.048Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:52.899", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388258, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58188", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H06968", "line": 6968, "raw_sha256": "883713801926a4f55adb933b9ed45a63bbc02ce2033b31d6e2cb5e7f7ac8524d", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732413, "epoch": 1603355392.902, "event_time": "2020-10-22T08:29:52.902Z", "collection_time": "2020-10-22T08:30:07.386Z", "delay_seconds": 14.484, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.5", "source_port": 389, "destination_port": 54452, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.386Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:52.902", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732413, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "389", "DestinationIp": "172.18.39.5", "DestinationPort": "54452", "Protocol": "udp", "Initiated": "false" } }, { "id": "H02114", "line": 2114, "raw_sha256": "e20fd1c3d8d44348a1d6d025307def43cea4ab2282ef6a577b143a2f8d5c9c73", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388259, "epoch": 1603355392.908, "event_time": "2020-10-22T08:29:52.908Z", "collection_time": "2020-10-22T08:29:57.048Z", "delay_seconds": 4.14, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58189, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.048Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:52.908", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388259, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58189", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02116", "line": 2116, "raw_sha256": "51c8a6f558f0aa07d677f1030c458b7d8125b2a8cce941b0681b79ebebb9da73", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388260, "epoch": 1603355392.928, "event_time": "2020-10-22T08:29:52.928Z", "collection_time": "2020-10-22T08:29:57.049Z", "delay_seconds": 4.121, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58190, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.049Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:52.928", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388260, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58190", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H00240", "line": 240, "raw_sha256": "14e4bba580b0724eec0833fb99e4709518a583628d80c55015370db02e34961c", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537141, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:53.908Z", "delay_seconds": 0.908, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x211ec28", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:53.908Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:53", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537141, "ProcessId": "0x0", "TargetLogonId": "0x211ec28", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.5", "IpPort": "58179" } }, { "id": "H00311", "line": 311, "raw_sha256": "1398928b322cc2b0a85c4811b3a44eafe3ab3ea2f8249f79c673090123b0c114", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537178, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:53.940Z", "delay_seconds": 0.94, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x211edd4", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:53.940Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:53", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537178, "ProcessId": "0x0", "TargetLogonId": "0x211edd4", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.5", "IpPort": "58180" } }, { "id": "H00788", "line": 788, "raw_sha256": "7c1fb54894d75862832326fed424014fc7609e9d9987dde9bf8b3e37fe6061d7", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4625, "channel": "Security", "host": "workstation5.theshire.local", "record_number": 134058, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.210Z", "delay_seconds": 2.21, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\lrodriguez", "caller_pid": 7520, "session": "0x9cc0b6", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0xc000006d", "substatus": "0xc000006a", "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 2, "raw": { "@timestamp": "2020-10-22T08:29:55.210Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4625, "Channel": "Security", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 134058, "ProcessId": "0x1d60", "SubjectLogonId": "0x9cc0b6", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "TargetUserName": "lrodriguez", "TargetDomainName": "theshire.local", "LogonType": "2", "Status": "0xc000006d", "SubStatus": "0xc000006a", "IpAddress": "-", "IpPort": "-" } }, { "id": "H00790", "line": 790, "raw_sha256": "c8ce6ca5ec4cb66f449c0f835671ed51b583015bfd0c8e070c3d737cb1944b11", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4625, "channel": "Security", "host": "workstation5.theshire.local", "record_number": 134059, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.211Z", "delay_seconds": 2.211, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 7520, "session": "0x9cc0b6", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0xc000006d", "substatus": "0xc000006a", "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 2, "raw": { "@timestamp": "2020-10-22T08:29:55.211Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4625, "Channel": "Security", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 134059, "ProcessId": "0x1d60", "SubjectLogonId": "0x9cc0b6", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "TargetUserName": "pgustavo", "TargetDomainName": "theshire.local", "LogonType": "2", "Status": "0xc000006d", "SubStatus": "0xc000006a", "IpAddress": "-", "IpPort": "-" } }, { "id": "H00792", "line": 792, "raw_sha256": "c0f77dc752332f508281b36085e0f50272f333db220e75b408799a0e55374e47", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4625, "channel": "Security", "host": "workstation5.theshire.local", "record_number": 134060, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.214Z", "delay_seconds": 2.214, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\sysmonsvc", "caller_pid": 7520, "session": "0x9cc0b6", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0xc000006d", "substatus": "0xc000006a", "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 2, "raw": { "@timestamp": "2020-10-22T08:29:55.214Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4625, "Channel": "Security", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 134060, "ProcessId": "0x1d60", "SubjectLogonId": "0x9cc0b6", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "TargetUserName": "sysmonsvc", "TargetDomainName": "theshire.local", "LogonType": "2", "Status": "0xc000006d", "SubStatus": "0xc000006a", "IpAddress": "-", "IpPort": "-" } }, { "id": "H00794", "line": 794, "raw_sha256": "94e8ef92f9748e66d5fe14b7c04720882cd50027518f4dc10093d25a6ed964d8", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4625, "channel": "Security", "host": "workstation5.theshire.local", "record_number": 134061, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.215Z", "delay_seconds": 2.215, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\sbeavers", "caller_pid": 7520, "session": "0x9cc0b6", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0xc000006d", "substatus": "0xc000006a", "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 2, "raw": { "@timestamp": "2020-10-22T08:29:55.215Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4625, "Channel": "Security", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 134061, "ProcessId": "0x1d60", "SubjectLogonId": "0x9cc0b6", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "TargetUserName": "sbeavers", "TargetDomainName": "theshire.local", "LogonType": "2", "Status": "0xc000006d", "SubStatus": "0xc000006a", "IpAddress": "-", "IpPort": "-" } }, { "id": "H00796", "line": 796, "raw_sha256": "d7516e8e47168796096c866e7107743df085b82f3216fdd4720f5c4892cd23e9", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4625, "channel": "Security", "host": "workstation5.theshire.local", "record_number": 134062, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.217Z", "delay_seconds": 2.217, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\mscott", "caller_pid": 7520, "session": "0x9cc0b6", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0xc000006d", "substatus": "0xc000006a", "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 2, "raw": { "@timestamp": "2020-10-22T08:29:55.217Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4625, "Channel": "Security", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 134062, "ProcessId": "0x1d60", "SubjectLogonId": "0x9cc0b6", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "TargetUserName": "mscott", "TargetDomainName": "theshire.local", "LogonType": "2", "Status": "0xc000006d", "SubStatus": "0xc000006a", "IpAddress": "-", "IpPort": "-" } }, { "id": "H00798", "line": 798, "raw_sha256": "0da6e3963567e6c3548767a27e5589fa641e01f2399e8d1822fa89ee5c927f92", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4625, "channel": "Security", "host": "workstation5.theshire.local", "record_number": 134063, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.219Z", "delay_seconds": 2.219, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pbeesly", "caller_pid": 7520, "session": "0x9cc0b6", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0xc000006d", "substatus": "0xc000006a", "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 2, "raw": { "@timestamp": "2020-10-22T08:29:55.219Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4625, "Channel": "Security", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 134063, "ProcessId": "0x1d60", "SubjectLogonId": "0x9cc0b6", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "TargetUserName": "pbeesly", "TargetDomainName": "theshire.local", "LogonType": "2", "Status": "0xc000006d", "SubStatus": "0xc000006a", "IpAddress": "-", "IpPort": "-" } }, { "id": "H00803", "line": 803, "raw_sha256": "0a74e034062c637f53151e0358eaafcce2e8fb10d308a5dbee40e316f2873fb6", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4625, "channel": "Security", "host": "workstation5.theshire.local", "record_number": 134064, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.222Z", "delay_seconds": 2.222, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\nxlogsvc", "caller_pid": 7520, "session": "0x9cc0b6", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0xc000006d", "substatus": "0xc000006a", "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 2, "raw": { "@timestamp": "2020-10-22T08:29:55.222Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4625, "Channel": "Security", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 134064, "ProcessId": "0x1d60", "SubjectLogonId": "0x9cc0b6", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "TargetUserName": "nxlogsvc", "TargetDomainName": "theshire.local", "LogonType": "2", "Status": "0xc000006d", "SubStatus": "0xc000006a", "IpAddress": "-", "IpPort": "-" } }, { "id": "H00945", "line": 945, "raw_sha256": "7db9f827637ab6cbffd4f6f97173ef97ae50fd5ac2998fb2039b747eecc7a604", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537190, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.315Z", "delay_seconds": 2.315, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x211f396", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:55.315Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537190, "ProcessId": "0x0", "TargetLogonId": "0x211f396", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.5", "IpPort": "58181" } }, { "id": "H00961", "line": 961, "raw_sha256": "a5ecdd779195c2a6dfcc019310331e41232d2ba62e79af758b02e030b68af61a", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537196, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.329Z", "delay_seconds": 2.329, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x211f4ed", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:55.329Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537196, "ProcessId": "0x0", "TargetLogonId": "0x211f4ed", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.5", "IpPort": "58182" } }, { "id": "H01125", "line": 1125, "raw_sha256": "25fdd0ab8f9390e638a55e0f9e7d5a4ac8975e0ba02f6aeedf4548b485ac5fb6", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537268, "epoch": 1603355393.0, "event_time": "2020-10-22T08:29:53.000Z", "collection_time": "2020-10-22T08:29:55.403Z", "delay_seconds": 2.403, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x17", "service": "sysmonsvc", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.403Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537268, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58185", "ServiceName": "sysmonsvc", "TicketEncryptionType": "0x17" } }, { "id": "H07100", "line": 7100, "raw_sha256": "0dabedd726a64e9833471921afa74b44fa2da9f12a4d1d93f62f9765f6ef0f1d", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732466, "epoch": 1603355393.005, "event_time": "2020-10-22T08:29:53.005Z", "collection_time": "2020-10-22T08:30:07.388Z", "delay_seconds": 14.383, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\network service", "target_account": null, "caller_pid": 964, "session": null, "guid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\svchost.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58183, "destination_port": 135, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.388Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:53.005", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732466, "User": "NT AUTHORITY\\NETWORK SERVICE", "Image": "C:\\Windows\\System32\\svchost.exe", "ProcessId": "964", "ProcessGuid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58183", "DestinationIp": "172.18.38.5", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07101", "line": 7101, "raw_sha256": "b220d6eb63d2b0e30e866fe05bed55918da1b2078d83d56789ffad47175ca9f8", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732467, "epoch": 1603355393.008, "event_time": "2020-10-22T08:29:53.008Z", "collection_time": "2020-10-22T08:30:07.388Z", "delay_seconds": 14.38, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58184, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.388Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:53.008", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732467, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58184", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02118", "line": 2118, "raw_sha256": "98df2b4e7cb30a3d8ea999e8678600c7dd095faeb6c2bb84152721c5d440d49a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388261, "epoch": 1603355393.017, "event_time": "2020-10-22T08:29:53.017Z", "collection_time": "2020-10-22T08:29:57.051Z", "delay_seconds": 4.034, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58192, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.051Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.017", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388261, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58192", "DestinationIp": "172.18.38.5", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02191", "line": 2191, "raw_sha256": "5e41af20a347617aefdfcc305fd96169b5280f6c60f162a8c7c2ce5ffb8b98fe", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222383, "epoch": 1603355393.02, "event_time": "2020-10-22T08:29:53.020Z", "collection_time": "2020-10-22T08:29:57.107Z", "delay_seconds": 4.087, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58194, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.107Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.020", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222383, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58194", "DestinationIp": "172.18.39.6", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02119", "line": 2119, "raw_sha256": "e18179e2ac3c8f8f689408b4926c7b86c183256108dd348da57d53499b7d8f50", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388262, "epoch": 1603355393.022, "event_time": "2020-10-22T08:29:53.022Z", "collection_time": "2020-10-22T08:29:57.051Z", "delay_seconds": 4.029, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58193, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.051Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.022", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388262, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58193", "DestinationIp": "172.18.39.7", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02120", "line": 2120, "raw_sha256": "e2788003d07f4d8ae3bcb79c059c204b5a65dc1b03a261b8884641d0bd49651a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388263, "epoch": 1603355393.023, "event_time": "2020-10-22T08:29:53.023Z", "collection_time": "2020-10-22T08:29:57.052Z", "delay_seconds": 4.029, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58194, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.052Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.023", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388263, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58194", "DestinationIp": "172.18.39.6", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H00272", "line": 272, "raw_sha256": "b2e277ee5a901027afc48d6c24ee0818d88bca924b13a391b1dc0eb5a488a119", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 731295, "epoch": 1603355393.03, "event_time": "2020-10-22T08:29:53.030Z", "collection_time": "2020-10-22T08:29:53.921Z", "delay_seconds": 0.891, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 7944, "session": "0x3e7", "guid": "{fddc55f3-4301-5f91-1406-000000000400}", "parent_guid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:53.921Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:53", "UtcTime": "2020-10-22 08:29:53.030", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 731295, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "CommandLine": "C:\\windows\\system32\\wbem\\wmiprvse.exe -Embedding", "ProcessId": "7944", "ProcessGuid": "{fddc55f3-4301-5f91-1406-000000000400}", "ParentProcessGuid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "920", "LogonId": "0x3e7" } }, { "id": "H02193", "line": 2193, "raw_sha256": "c21f02cd230f1650bc4a2c49e82dbe11fa5a23c31d772ef9942d83345cc705a2", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222384, "epoch": 1603355393.034, "event_time": "2020-10-22T08:29:53.034Z", "collection_time": "2020-10-22T08:29:57.108Z", "delay_seconds": 4.074, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58196, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.108Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.034", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222384, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58196", "DestinationIp": "172.18.39.6", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02121", "line": 2121, "raw_sha256": "3e8bba6527326ac4ae20599f3296a1d429a3bef8212c01a070db3d1eb215bf62", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388264, "epoch": 1603355393.036, "event_time": "2020-10-22T08:29:53.036Z", "collection_time": "2020-10-22T08:29:57.052Z", "delay_seconds": 4.016, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{313fa531-ba35-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58196, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.052Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.036", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388264, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{313fa531-ba35-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58196", "DestinationIp": "172.18.39.6", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02123", "line": 2123, "raw_sha256": "90535da1a7c0c92d7058867d601c662b74efd9cf129cc25f4c0beff215b04217", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388265, "epoch": 1603355393.062, "event_time": "2020-10-22T08:29:53.062Z", "collection_time": "2020-10-22T08:29:57.053Z", "delay_seconds": 3.991, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58197, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.053Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.062", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388265, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58197", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02125", "line": 2125, "raw_sha256": "fd9fbad12f304fa5a95e3f6474177ab6765410d2a39b1fd69178300d49844eed", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388266, "epoch": 1603355393.067, "event_time": "2020-10-22T08:29:53.067Z", "collection_time": "2020-10-22T08:29:57.054Z", "delay_seconds": 3.987, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58198, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.054Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.067", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388266, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58198", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02127", "line": 2127, "raw_sha256": "eb8a3df2d4b3068d6dda4dae442f69f4ab266340a27e514bfcd628a3c59f8df7", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388267, "epoch": 1603355393.078, "event_time": "2020-10-22T08:29:53.078Z", "collection_time": "2020-10-22T08:29:57.055Z", "delay_seconds": 3.977, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{313fa531-ba35-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58199, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.055Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.078", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388267, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{313fa531-ba35-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58199", "DestinationIp": "172.18.38.5", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02129", "line": 2129, "raw_sha256": "43270b02924e140e7af5c3f6c0117b967b2ee5098a7d63d66f3f55dcf1ff8c36", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388268, "epoch": 1603355393.082, "event_time": "2020-10-22T08:29:53.082Z", "collection_time": "2020-10-22T08:29:57.056Z", "delay_seconds": 3.974, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58200, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.056Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.082", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388268, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58200", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02132", "line": 2132, "raw_sha256": "bd97496bac6fc1cf48f94c943b20fbdf09ee83b6ec0d3894e6c824859612311a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388269, "epoch": 1603355393.085, "event_time": "2020-10-22T08:29:53.085Z", "collection_time": "2020-10-22T08:29:57.057Z", "delay_seconds": 3.972, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{313fa531-ba35-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58201, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.057Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.085", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388269, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{313fa531-ba35-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58201", "DestinationIp": "172.18.39.7", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02134", "line": 2134, "raw_sha256": "9f8e3a75cbbbddebfee021477005b5ccc95d279897eb9653c1bf2e2d2a66c4d9", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388270, "epoch": 1603355393.087, "event_time": "2020-10-22T08:29:53.087Z", "collection_time": "2020-10-22T08:29:57.076Z", "delay_seconds": 3.989, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58202, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.076Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.087", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388270, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58202", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02137", "line": 2137, "raw_sha256": "c1d6d2ca19a287e3ff1e21fe4272594332ba30e456cdf3bc0c22f17a9a62312f", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388271, "epoch": 1603355393.107, "event_time": "2020-10-22T08:29:53.107Z", "collection_time": "2020-10-22T08:29:57.079Z", "delay_seconds": 3.972, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58203, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.079Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.107", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388271, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58203", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02163", "line": 2163, "raw_sha256": "0d13c8e4d973b81f22f00ce28f87ba021be633eeb10f1878c3af3a4188a0d27f", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388280, "epoch": 1603355393.125, "event_time": "2020-10-22T08:29:53.125Z", "collection_time": "2020-10-22T08:29:57.091Z", "delay_seconds": 3.966, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58204, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.091Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.125", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388280, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58204", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02164", "line": 2164, "raw_sha256": "92fe72f2d81bcf48a498dc71f50f3ddaa0135a0cdc5067849c63f5146f5a48b4", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388281, "epoch": 1603355393.2, "event_time": "2020-10-22T08:29:53.200Z", "collection_time": "2020-10-22T08:29:57.092Z", "delay_seconds": 3.892, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58206, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.092Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.200", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388281, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58206", "DestinationIp": "172.18.39.7", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02165", "line": 2165, "raw_sha256": "3d4b3ed4526cc57a6a52be19f130f46548f938b83859bccbd4e496f5914e3a0c", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388282, "epoch": 1603355393.201, "event_time": "2020-10-22T08:29:53.201Z", "collection_time": "2020-10-22T08:29:57.093Z", "delay_seconds": 3.892, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58207, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.093Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.201", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388282, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58207", "DestinationIp": "172.18.38.5", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02404", "line": 2404, "raw_sha256": "47a37e2e8a914eaf2cbf5ab98bc79dee1c465b78bd8f8d61f98d430675e4b1cb", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222495, "epoch": 1603355393.201, "event_time": "2020-10-22T08:29:53.201Z", "collection_time": "2020-10-22T08:29:57.231Z", "delay_seconds": 4.03, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58208, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.231Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.201", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222495, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58208", "DestinationIp": "172.18.39.6", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02166", "line": 2166, "raw_sha256": "abf2e9b86970c603552ef9fe37573b63c76207d4c7cdc4f21d86600dc1699816", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388283, "epoch": 1603355393.203, "event_time": "2020-10-22T08:29:53.203Z", "collection_time": "2020-10-22T08:29:57.093Z", "delay_seconds": 3.89, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58208, "destination_port": 445, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.093Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.203", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388283, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58208", "DestinationIp": "172.18.39.6", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H07459", "line": 7459, "raw_sha256": "867b9d485f8c79456bf05d1ea183e06c55a44e209360f809d30061fed4367125", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732563, "epoch": 1603355393.328, "event_time": "2020-10-22T08:29:53.328Z", "collection_time": "2020-10-22T08:30:07.623Z", "delay_seconds": 14.295, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58185, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.623Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.328", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732563, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58185", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07460", "line": 7460, "raw_sha256": "526b606083f0ade59adf9d91a073e152d3bf4db597714b64141963b11a122ca2", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732564, "epoch": 1603355393.36, "event_time": "2020-10-22T08:29:53.360Z", "collection_time": "2020-10-22T08:30:07.623Z", "delay_seconds": 14.263, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58186, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.623Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.360", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732564, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58186", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07461", "line": 7461, "raw_sha256": "3f7d879e1dbc4448448344f0e17687e18ec1d74f46b843c47084cfdc70b8fd2a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732565, "epoch": 1603355393.365, "event_time": "2020-10-22T08:29:53.365Z", "collection_time": "2020-10-22T08:30:07.623Z", "delay_seconds": 14.258, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58187, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.623Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.365", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732565, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58187", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07462", "line": 7462, "raw_sha256": "05a0507939d2c04326a5763af4694c52654e56d231f041337421ea90ad1a2a61", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732566, "epoch": 1603355393.368, "event_time": "2020-10-22T08:29:53.368Z", "collection_time": "2020-10-22T08:30:07.623Z", "delay_seconds": 14.255, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58188, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.623Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.368", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732566, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58188", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07463", "line": 7463, "raw_sha256": "1c16a91ab6c195e2add7ad050682119f8eb629867ccc6966b7c9c0695bd18842", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732567, "epoch": 1603355393.381, "event_time": "2020-10-22T08:29:53.381Z", "collection_time": "2020-10-22T08:30:07.623Z", "delay_seconds": 14.242, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58189, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.623Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.381", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732567, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58189", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07464", "line": 7464, "raw_sha256": "0a7de151ff3b86d72807b77e59ca946dcfcc2963bc38563b90f8a1ebd3588d3d", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732568, "epoch": 1603355393.397, "event_time": "2020-10-22T08:29:53.397Z", "collection_time": "2020-10-22T08:30:07.623Z", "delay_seconds": 14.226, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58190, "destination_port": 389, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.623Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.397", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732568, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58190", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07812", "line": 7812, "raw_sha256": "886c90489a5c0c54cca1ff8f3a074aef0f7ed9dd0ef4dfee97c67758d3913f37", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732683, "epoch": 1603355393.486, "event_time": "2020-10-22T08:29:53.486Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.436, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58192, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.486", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732683, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58192", "DestinationIp": "172.18.38.5", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07815", "line": 7815, "raw_sha256": "382ece9911f182ae51fdde76f535e71a4927defbd10e05e78083cb2b21cdff9e", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732684, "epoch": 1603355393.486, "event_time": "2020-10-22T08:29:53.486Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.436, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3512, "session": null, "guid": "{fddc55f3-b938-5f8f-5100-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\dns.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.5", "source_port": 53, "destination_port": 58941, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.486", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732684, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dns.exe", "ProcessId": "3512", "ProcessGuid": "{fddc55f3-b938-5f8f-5100-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "53", "DestinationIp": "172.18.39.5", "DestinationPort": "58941", "Protocol": "udp", "Initiated": "false" } }, { "id": "H07817", "line": 7817, "raw_sha256": "6d9233ebcf34cdf7bdeb19391c298db1ad6a02e12c936842f25f76c5d5402864", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732685, "epoch": 1603355393.487, "event_time": "2020-10-22T08:29:53.487Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.435, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3512, "session": null, "guid": "{fddc55f3-b938-5f8f-5100-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\dns.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.5", "source_port": 53, "destination_port": 57803, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.487", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732685, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dns.exe", "ProcessId": "3512", "ProcessGuid": "{fddc55f3-b938-5f8f-5100-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "53", "DestinationIp": "172.18.39.5", "DestinationPort": "57803", "Protocol": "udp", "Initiated": "false" } }, { "id": "H07820", "line": 7820, "raw_sha256": "5650bc1f2c48a788898a18a8fd911809b39257b46e8e2e5ccd74769c443746e4", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732686, "epoch": 1603355393.531, "event_time": "2020-10-22T08:29:53.531Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.391, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58197, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.531", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732686, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58197", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07823", "line": 7823, "raw_sha256": "68e3318670c2a12a6813d61443449414577657dac9334dbceb9fba8fab0e8f6b", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732687, "epoch": 1603355393.536, "event_time": "2020-10-22T08:29:53.536Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.386, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58198, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.536", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732687, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58198", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07826", "line": 7826, "raw_sha256": "76a06f4984fc4e7b4eb5bc1da6f53edfdca3bf06885438b9d2bd91bac717e4f9", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732688, "epoch": 1603355393.548, "event_time": "2020-10-22T08:29:53.548Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.374, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58199, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.548", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732688, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58199", "DestinationIp": "172.18.38.5", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07829", "line": 7829, "raw_sha256": "cd3279b999b424df8e66a5cfaa3430cf45a72aea6802b7e0f0429b51963fc929", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732689, "epoch": 1603355393.552, "event_time": "2020-10-22T08:29:53.552Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.37, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58200, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.552", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732689, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58200", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07832", "line": 7832, "raw_sha256": "40ab85c16214ef7fa13832c8bb3d5001107f6dfa17cb564953b4a516f4d8628b", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732690, "epoch": 1603355393.557, "event_time": "2020-10-22T08:29:53.557Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.365, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58202, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.557", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732690, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58202", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07836", "line": 7836, "raw_sha256": "b6ac1cfbd3f750ae2628ce14b163eba5020683de592dd01c44273536ae0783bc", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732691, "epoch": 1603355393.576, "event_time": "2020-10-22T08:29:53.576Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.346, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58203, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.576", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732691, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58203", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07838", "line": 7838, "raw_sha256": "9cacee2a1e3184a384bc0d6c91f83fcf8b01379e36edbebe39794ed4bbf995b2", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732692, "epoch": 1603355393.594, "event_time": "2020-10-22T08:29:53.594Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.328, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58204, "destination_port": 389, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.594", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732692, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58204", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H07841", "line": 7841, "raw_sha256": "39e8d6ddd02d9b0c7d1d7a7dfa503659cee44cff99d3b41b5dc5d656b8faf905", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732693, "epoch": 1603355393.67, "event_time": "2020-10-22T08:29:53.670Z", "collection_time": "2020-10-22T08:30:07.922Z", "delay_seconds": 14.252, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58207, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.922Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:30:03", "UtcTime": "2020-10-22 08:29:53.670", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732693, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58207", "DestinationIp": "172.18.38.5", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H00642", "line": 642, "raw_sha256": "a487785b22b712965c7b6ab542a240f575b53d9bccd202e9f8aeaa091e5e1f4f", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388133, "epoch": 1603355393.964, "event_time": "2020-10-22T08:29:53.964Z", "collection_time": "2020-10-22T08:29:54.118Z", "delay_seconds": 0.154, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 6660, "session": "0x3e7", "guid": "{313fa531-4301-5f91-af04-000000000400}", "parent_guid": "{313fa531-ba56-5f8f-7400-000000000400}", "image": "C:\\Windows\\System32\\SearchProtocolHost.exe", "parent_image": "C:\\Windows\\System32\\SearchIndexer.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:54.118Z", "EventTime": "2020-10-22 04:29:53", "EventReceivedTime": "2020-10-22 04:29:54", "UtcTime": "2020-10-22 08:29:53.964", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388133, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\SearchProtocolHost.exe", "CommandLine": "\"C:\\windows\\system32\\SearchProtocolHost.exe\" Global\\UsGthrFltPipeMssGthrPipe4_ Global\\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 \"Software\\Microsoft\\Windows Search\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)\" \"C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\usgthrsvc\" \"DownLevelDaemon\" ", "ProcessId": "6660", "ProcessGuid": "{313fa531-4301-5f91-af04-000000000400}", "ParentProcessGuid": "{313fa531-ba56-5f8f-7400-000000000400}", "ParentImage": "C:\\Windows\\System32\\SearchIndexer.exe", "ParentProcessId": "3188", "LogonId": "0x3e7" } }, { "id": "H02783", "line": 2783, "raw_sha256": "9eaad8b719ee35f6297f88f6ae55397f86a11302080fba4d47712e2c3edc6f00", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388289, "epoch": 1603355393.978, "event_time": "2020-10-22T08:29:53.978Z", "collection_time": "2020-10-22T08:29:57.444Z", "delay_seconds": 3.466, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58209, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.444Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.978", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388289, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58209", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02788", "line": 2788, "raw_sha256": "bd9b155def5651b6503f9ae66e5e702eb532a7fecc3fc72e0577172ef532d4bd", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388290, "epoch": 1603355393.989, "event_time": "2020-10-22T08:29:53.989Z", "collection_time": "2020-10-22T08:29:57.447Z", "delay_seconds": 3.458, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58212, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.447Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.989", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388290, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58212", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02791", "line": 2791, "raw_sha256": "24306cc4643644ba25a524eea95176988ccfb38c38333b100bba02c69c9b6078", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388291, "epoch": 1603355393.989, "event_time": "2020-10-22T08:29:53.989Z", "collection_time": "2020-10-22T08:29:57.452Z", "delay_seconds": 3.463, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58213, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.452Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.989", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388291, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58213", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02795", "line": 2795, "raw_sha256": "bb5abf7f66ee69a1052f9571e5e6df220131799030c267f14ffc74b549a1adfe", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388292, "epoch": 1603355393.997, "event_time": "2020-10-22T08:29:53.997Z", "collection_time": "2020-10-22T08:29:57.454Z", "delay_seconds": 3.457, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58214, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.454Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.997", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388292, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58214", "DestinationIp": "172.18.39.7", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02800", "line": 2800, "raw_sha256": "86b94e144f8d65554517a580fca225838e149cf0d61d66f844c3ccb9076d8afe", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388293, "epoch": 1603355393.997, "event_time": "2020-10-22T08:29:53.997Z", "collection_time": "2020-10-22T08:29:57.460Z", "delay_seconds": 3.463, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58215, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.460Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:53.997", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388293, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58215", "DestinationIp": "172.18.38.5", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H01136", "line": 1136, "raw_sha256": "3da7dad70141df30003333a552e06ba2d7651d993a8d3e5f0a1d4d2a21ffcc39", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537278, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.412Z", "delay_seconds": 1.412, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x17", "service": "nxlogsvc", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.412Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537278, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58186", "ServiceName": "nxlogsvc", "TicketEncryptionType": "0x17" } }, { "id": "H01140", "line": 1140, "raw_sha256": "0f0364580b5207cc30a7fe8b7362d86fc4144cb1f222a9d546b7dbb7857cd816", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537280, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.414Z", "delay_seconds": 1.414, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x17", "service": "defensesvc", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.414Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537280, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58187", "ServiceName": "defensesvc", "TicketEncryptionType": "0x17" } }, { "id": "H01144", "line": 1144, "raw_sha256": "3045d2d1e74ab4c552f62a47f0e6be565e7a9f10d9891e0b5048eef93723b0ef", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537282, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.417Z", "delay_seconds": 1.417, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x17", "service": "otrsvc", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.417Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537282, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58188", "ServiceName": "otrsvc", "TicketEncryptionType": "0x17" } }, { "id": "H01148", "line": 1148, "raw_sha256": "7e2aea4392e8271d3783c9b631fbff0141b5a89d96f4e80812167e95c2e33113", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537284, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.419Z", "delay_seconds": 1.419, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x17", "service": "mordorsvc", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.419Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537284, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58189", "ServiceName": "mordorsvc", "TicketEncryptionType": "0x17" } }, { "id": "H01163", "line": 1163, "raw_sha256": "fa58f6a7074195eba706545989b87ef583b34ccbec19d3f1feaf427af6f6f9b4", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537291, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.432Z", "delay_seconds": 1.432, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WEC$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.432Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537291, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58197", "ServiceName": "WEC$", "TicketEncryptionType": "0x12" } }, { "id": "H01170", "line": 1170, "raw_sha256": "f0b98ac04e3027821e10ddf2d568d2e076ff4db8a57d36998e6ba2a7e9935061", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537293, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.437Z", "delay_seconds": 1.437, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WORKSTATION6$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.437Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537293, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58198", "ServiceName": "WORKSTATION6$", "TicketEncryptionType": "0x12" } }, { "id": "H01178", "line": 1178, "raw_sha256": "e6ae5994a1885f3a0adce6af42af8a8b54162675e9c8e7cca538860bd36bcf7f", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537296, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.441Z", "delay_seconds": 1.441, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "MORDORDC$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.441Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537296, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58200", "ServiceName": "MORDORDC$", "TicketEncryptionType": "0x12" } }, { "id": "H01183", "line": 1183, "raw_sha256": "9aa7d96a5acafc794dc570c0615a85ec3d8dfc194fcfaff7f6ed08c82a8963cb", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537298, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.444Z", "delay_seconds": 1.444, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "krbtgt", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.444Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537298, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58202", "ServiceName": "krbtgt", "TicketEncryptionType": "0x12" } }, { "id": "H01190", "line": 1190, "raw_sha256": "98efd6952342af486d944d0560b5422cd565a0e8eaa203e8497b9acec539ac33", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537300, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.450Z", "delay_seconds": 1.45, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x2122d2d", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:55.450Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537300, "ProcessId": "0x0", "TargetLogonId": "0x2122d2d", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.5", "IpPort": "58199" } }, { "id": "H01198", "line": 1198, "raw_sha256": "da6b9f1b2cc6726aedbc810fe3ea8eeda0b3478e7d31bd65cb8a55983c5a6028", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 5145, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537303, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.455Z", "delay_seconds": 1.455, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": null, "session": "0x2122d2d", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "\\\\*\\IPC$", "share_target": "srvsvc", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.455Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 5145, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537303, "SubjectLogonId": "0x2122d2d", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "IpAddress": "172.18.39.5", "IpPort": "58199", "ShareName": "\\\\*\\IPC$", "RelativeTargetName": "srvsvc", "AccessMask": "0x12019f" } }, { "id": "H01203", "line": 1203, "raw_sha256": "977a1fcb9b12468e3179a5ee13bde19efb9c2d0b30c4a4a89d7c7746b033d3da", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537305, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.460Z", "delay_seconds": 1.46, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WORKSTATION7$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.460Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537305, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58203", "ServiceName": "WORKSTATION7$", "TicketEncryptionType": "0x12" } }, { "id": "H01269", "line": 1269, "raw_sha256": "0efff3904b01c5ea1dbbd1279596b04dfc211c10de082e0831d9f403975712a5", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation7.theshire.local", "record_number": 114389, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.507Z", "delay_seconds": 1.507, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x9b1a6d", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:55.507Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 114389, "ProcessId": "0x0", "TargetLogonId": "0x9b1a6d", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.5", "IpPort": "58201" } }, { "id": "H01284", "line": 1284, "raw_sha256": "940d19221f23ea0c190d49af6d88e2335a09550468784030c7aa89b53bfe652b", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 5145, "channel": "Security", "host": "workstation7.theshire.local", "record_number": 114392, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.517Z", "delay_seconds": 1.517, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": null, "session": "0x9b1a6d", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "\\\\*\\IPC$", "share_target": "srvsvc", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.517Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 5145, "Channel": "Security", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 114392, "SubjectLogonId": "0x9b1a6d", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "IpAddress": "172.18.39.5", "IpPort": "58201", "ShareName": "\\\\*\\IPC$", "RelativeTargetName": "srvsvc", "AccessMask": "0x12019f" } }, { "id": "H01309", "line": 1309, "raw_sha256": "a8e38759e119ac2426c836378d7c144a09d0f5722b3d210855d97f0c99239a0a", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation6.theshire.local", "record_number": 111482, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.532Z", "delay_seconds": 1.532, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x8fc1d9", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:55.532Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 111482, "ProcessId": "0x0", "TargetLogonId": "0x8fc1d9", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.5", "IpPort": "58196" } }, { "id": "H01324", "line": 1324, "raw_sha256": "f79e194ce47928d6ccc98cf7dde8f79d30e5449adca1d62fe400b0f780ac6160", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 5145, "channel": "Security", "host": "workstation6.theshire.local", "record_number": 111485, "epoch": 1603355394.0, "event_time": "2020-10-22T08:29:54.000Z", "collection_time": "2020-10-22T08:29:55.545Z", "delay_seconds": 1.545, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": null, "session": "0x8fc1d9", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "\\\\*\\IPC$", "share_target": "srvsvc", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.545Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 5145, "Channel": "Security", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 111485, "SubjectLogonId": "0x8fc1d9", "SubjectUserName": "pgustavo", "SubjectDomainName": "THESHIRE", "IpAddress": "172.18.39.5", "IpPort": "58196", "ShareName": "\\\\*\\IPC$", "RelativeTargetName": "srvsvc", "AccessMask": "0x12019f" } }, { "id": "H00771", "line": 771, "raw_sha256": "8be77358c94e15fecc336893b9c456423a0d21a603518743025fc78f5cccbe25", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388173, "epoch": 1603355394.024, "event_time": "2020-10-22T08:29:54.024Z", "collection_time": "2020-10-22T08:29:55.201Z", "delay_seconds": 1.177, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 9000, "session": "0x3e7", "guid": "{313fa531-4302-5f91-b004-000000000400}", "parent_guid": "{313fa531-ba56-5f8f-7400-000000000400}", "image": "C:\\Windows\\System32\\SearchFilterHost.exe", "parent_image": "C:\\Windows\\System32\\SearchIndexer.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.201Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:54.024", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388173, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\SearchFilterHost.exe", "CommandLine": "\"C:\\windows\\system32\\SearchFilterHost.exe\" 0 768 772 780 8192 776 ", "ProcessId": "9000", "ProcessGuid": "{313fa531-4302-5f91-b004-000000000400}", "ParentProcessGuid": "{313fa531-ba56-5f8f-7400-000000000400}", "ParentImage": "C:\\Windows\\System32\\SearchIndexer.exe", "ParentProcessId": "3188", "LogonId": "0x3e7" } }, { "id": "H01939", "line": 1939, "raw_sha256": "1d75a18456ba43b4003342201201c95910d788f8ee1426bdbf57d31fa3a122d8", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243492, "epoch": 1603355394.088, "event_time": "2020-10-22T08:29:54.088Z", "collection_time": "2020-10-22T08:29:55.957Z", "delay_seconds": 1.869, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58193, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.957Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:54.088", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243492, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58193", "DestinationIp": "172.18.39.7", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H01942", "line": 1942, "raw_sha256": "c06a2ff50c113bc9ecdfdc96771b05233b83b73daa9bb5b651c3d5dd77343f45", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243493, "epoch": 1603355394.151, "event_time": "2020-10-22T08:29:54.151Z", "collection_time": "2020-10-22T08:29:55.958Z", "delay_seconds": 1.807, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58201, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:55.958Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:55", "UtcTime": "2020-10-22 08:29:54.151", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243493, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58201", "DestinationIp": "172.18.39.7", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02596", "line": 2596, "raw_sha256": "4ef5325bd04b0f3251b6f796278a765a5ff4dbc56caa1d2241c35dc6aac88cf1", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243760, "epoch": 1603355394.267, "event_time": "2020-10-22T08:29:54.267Z", "collection_time": "2020-10-22T08:29:57.340Z", "delay_seconds": 3.073, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58206, "destination_port": 445, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.340Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:54.267", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243760, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58206", "DestinationIp": "172.18.39.7", "DestinationPort": "445", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H13935", "line": 13935, "raw_sha256": "67342b85828cbcd629f9492a76ddeeb52bb3fa3db19467397e0053e0d836e99a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736773, "epoch": 1603355394.448, "event_time": "2020-10-22T08:29:54.448Z", "collection_time": "2020-10-22T08:30:14.144Z", "delay_seconds": 19.696, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58209, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.144Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.448", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736773, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58209", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H13936", "line": 13936, "raw_sha256": "1b93a52ca5b2a43d03501571def991653b9a875bddc31bd8519a6171628fab4f", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736774, "epoch": 1603355394.458, "event_time": "2020-10-22T08:29:54.458Z", "collection_time": "2020-10-22T08:30:14.144Z", "delay_seconds": 19.686, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58212, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.144Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.458", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736774, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58212", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H13938", "line": 13938, "raw_sha256": "c763495528bfb6340fcfe8f5911e0b610d37c1c96defcef63422d2de8867d2bf", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736776, "epoch": 1603355394.459, "event_time": "2020-10-22T08:29:54.459Z", "collection_time": "2020-10-22T08:30:14.146Z", "delay_seconds": 19.687, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58213, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.146Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.459", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736776, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58213", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H13940", "line": 13940, "raw_sha256": "6d7f99968885e9ce902c9c71b4c69e364557b1c7b5a8d4aeb3c5d84da5a05f45", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736778, "epoch": 1603355394.466, "event_time": "2020-10-22T08:29:54.466Z", "collection_time": "2020-10-22T08:30:14.146Z", "delay_seconds": 19.68, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58215, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.146Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.466", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736778, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58215", "DestinationIp": "172.18.38.5", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H13941", "line": 13941, "raw_sha256": "3242217ea02e67609c59d35678fde22632488262aa45ed03a220d04567a66ad3", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736779, "epoch": 1603355394.501, "event_time": "2020-10-22T08:29:54.501Z", "collection_time": "2020-10-22T08:30:14.147Z", "delay_seconds": 19.646, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.7", "source_port": 389, "destination_port": 59755, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.147Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.501", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736779, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "389", "DestinationIp": "172.18.39.7", "DestinationPort": "59755", "Protocol": "udp", "Initiated": "false" } }, { "id": "H03874", "line": 3874, "raw_sha256": "9c5110a290b0bfdba189b91aa30681c0d9fb990eaaeb77dec8baaf7026c8852f", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388298, "epoch": 1603355394.511, "event_time": "2020-10-22T08:29:54.511Z", "collection_time": "2020-10-22T08:29:59.618Z", "delay_seconds": 5.107, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58217, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:59.618Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:59", "UtcTime": "2020-10-22 08:29:54.511", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388298, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{313fa531-ba3b-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58217", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02758", "line": 2758, "raw_sha256": "aaf8edcf14e18d81b8eae4c3cbf7c1206454450d3c42c2348a5d509a14a2bb1d", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222615, "epoch": 1603355394.514, "event_time": "2020-10-22T08:29:54.514Z", "collection_time": "2020-10-22T08:29:57.431Z", "delay_seconds": 2.917, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58218, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.431Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:54.514", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222615, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58218", "DestinationIp": "172.18.39.6", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H03882", "line": 3882, "raw_sha256": "509beec85e6e786dd9dae907954b324a1296358c86f86646277c95f4e160afa3", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388299, "epoch": 1603355394.516, "event_time": "2020-10-22T08:29:54.516Z", "collection_time": "2020-10-22T08:29:59.622Z", "delay_seconds": 5.106, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58218, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:59.622Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:59", "UtcTime": "2020-10-22 08:29:54.516", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388299, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58218", "DestinationIp": "172.18.39.6", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H13943", "line": 13943, "raw_sha256": "fb0cbe5c7f2884f77d8ab3617a6056b6a2c1a383a3027e2f5a7b8cadc18a77ac", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736781, "epoch": 1603355394.541, "event_time": "2020-10-22T08:29:54.541Z", "collection_time": "2020-10-22T08:30:14.148Z", "delay_seconds": 19.607, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "fe80::a1cd:665f:9ac2:55c1", "destination_ip": "fe80::a1cd:665f:9ac2:55c1", "source_port": 53107, "destination_port": 135, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.148Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.541", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736781, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "SourcePort": "53107", "DestinationIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H13945", "line": 13945, "raw_sha256": "fa6848e1920cb98a3839060e69b2a3a44deb674afb6dc4fac031e96b3d5bf286", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736783, "epoch": 1603355394.541, "event_time": "2020-10-22T08:29:54.541Z", "collection_time": "2020-10-22T08:30:14.149Z", "delay_seconds": 19.608, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\network service", "target_account": null, "caller_pid": 964, "session": null, "guid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\svchost.exe", "parent_image": "", "client_ip": null, "source_ip": "fe80::a1cd:665f:9ac2:55c1", "destination_ip": "fe80::a1cd:665f:9ac2:55c1", "source_port": 53107, "destination_port": 135, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.149Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.541", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736783, "User": "NT AUTHORITY\\NETWORK SERVICE", "Image": "C:\\Windows\\System32\\svchost.exe", "ProcessId": "964", "ProcessGuid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "SourceIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "SourcePort": "53107", "DestinationIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02761", "line": 2761, "raw_sha256": "c63dd2ca40d6c82db43cbe08eae53d15c92b5d0bfc714a0478425c367e450a76", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222616, "epoch": 1603355394.55, "event_time": "2020-10-22T08:29:54.550Z", "collection_time": "2020-10-22T08:29:57.433Z", "delay_seconds": 2.883, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 57595, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.433Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:54.550", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222616, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "57595", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "udp", "Initiated": "true" } }, { "id": "H13946", "line": 13946, "raw_sha256": "d4a461284d07e4106244aa25d84523585edbcf2c7e5f41fbb0ef8a1ed523395c", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736784, "epoch": 1603355394.55, "event_time": "2020-10-22T08:29:54.550Z", "collection_time": "2020-10-22T08:30:14.150Z", "delay_seconds": 19.6, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "fe80::a1cd:665f:9ac2:55c1", "destination_ip": "fe80::a1cd:665f:9ac2:55c1", "source_port": 53108, "destination_port": 49674, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.150Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.550", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736784, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "SourcePort": "53108", "DestinationIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H13948", "line": 13948, "raw_sha256": "70383ba7bba747b17fa2d004565689445edf3176ac05338b93d1cc491d206691", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 736786, "epoch": 1603355394.55, "event_time": "2020-10-22T08:29:54.550Z", "collection_time": "2020-10-22T08:30:14.151Z", "delay_seconds": 19.601, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "fe80::a1cd:665f:9ac2:55c1", "destination_ip": "fe80::a1cd:665f:9ac2:55c1", "source_port": 53108, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:14.151Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:14", "UtcTime": "2020-10-22 08:29:54.550", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 736786, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "SourcePort": "53108", "DestinationIp": "fe80:0:0:0:a1cd:665f:9ac2:55c1", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16734", "line": 16734, "raw_sha256": "5a1232e8375fe28dffe2107baebe9298d3fa440f6aacbe624a3b6a1be4fd5894", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739564, "epoch": 1603355394.611, "event_time": "2020-10-22T08:29:54.611Z", "collection_time": "2020-10-22T08:30:21.425Z", "delay_seconds": 26.814, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\network service", "target_account": null, "caller_pid": 964, "session": null, "guid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\svchost.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61396, "destination_port": 135, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.425Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.611", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739564, "User": "NT AUTHORITY\\NETWORK SERVICE", "Image": "C:\\Windows\\System32\\svchost.exe", "ProcessId": "964", "ProcessGuid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61396", "DestinationIp": "172.18.38.5", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16735", "line": 16735, "raw_sha256": "08fac910d0b55d09cc6dbd1ae0201a951847f09509913cd32e48e0d28f4a2392", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739565, "epoch": 1603355394.614, "event_time": "2020-10-22T08:29:54.614Z", "collection_time": "2020-10-22T08:30:21.425Z", "delay_seconds": 26.811, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61397, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.425Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.614", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739565, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61397", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16736", "line": 16736, "raw_sha256": "20e8721b7dbbd822280bc158d868e3522aa7b084918c0af8b477c4a322179a56", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739566, "epoch": 1603355394.616, "event_time": "2020-10-22T08:29:54.616Z", "collection_time": "2020-10-22T08:30:21.426Z", "delay_seconds": 26.81, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3512, "session": null, "guid": "{fddc55f3-b938-5f8f-5100-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\dns.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.7", "source_port": 53, "destination_port": 60287, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.426Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.616", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739566, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dns.exe", "ProcessId": "3512", "ProcessGuid": "{fddc55f3-b938-5f8f-5100-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "53", "DestinationIp": "172.18.39.7", "DestinationPort": "60287", "Protocol": "udp", "Initiated": "false" } }, { "id": "H16737", "line": 16737, "raw_sha256": "111ca7076523ecef7d4c11be77c450c2f3242c6976c97fec994a61a077060836", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739567, "epoch": 1603355394.618, "event_time": "2020-10-22T08:29:54.618Z", "collection_time": "2020-10-22T08:30:21.426Z", "delay_seconds": 26.808, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.7", "source_port": 389, "destination_port": 60288, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.426Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.618", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739567, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "389", "DestinationIp": "172.18.39.7", "DestinationPort": "60288", "Protocol": "udp", "Initiated": "false" } }, { "id": "H16738", "line": 16738, "raw_sha256": "76bed5712215ac0d6f79bc9e2d9aa0a63e698dcc2f40af0a474245848992d33a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739568, "epoch": 1603355394.635, "event_time": "2020-10-22T08:29:54.635Z", "collection_time": "2020-10-22T08:30:21.428Z", "delay_seconds": 26.793, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\network service", "target_account": null, "caller_pid": 964, "session": null, "guid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\svchost.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.6", "destination_ip": "172.18.38.5", "source_port": 51848, "destination_port": 135, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.428Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.635", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739568, "User": "NT AUTHORITY\\NETWORK SERVICE", "Image": "C:\\Windows\\System32\\svchost.exe", "ProcessId": "964", "ProcessGuid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "SourceIp": "172.18.38.6", "SourcePort": "51848", "DestinationIp": "172.18.38.5", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16739", "line": 16739, "raw_sha256": "406ba7e14bd4467bc5509c0c893531982b75091156e664f4bb1e691320ea4f13", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739569, "epoch": 1603355394.639, "event_time": "2020-10-22T08:29:54.639Z", "collection_time": "2020-10-22T08:30:21.428Z", "delay_seconds": 26.789, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.6", "destination_ip": "172.18.38.5", "source_port": 51849, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.428Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.639", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739569, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.6", "SourcePort": "51849", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H03132", "line": 3132, "raw_sha256": "666d88be2ff3e91384b19c757fe0425f6df0a56d18ecb417efba4e31abb624de", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222706, "epoch": 1603355394.661, "event_time": "2020-10-22T08:29:54.661Z", "collection_time": "2020-10-22T08:29:58.691Z", "delay_seconds": 4.03, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53280, "destination_port": 135, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.691Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:58", "UtcTime": "2020-10-22 08:29:54.661", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222706, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53280", "DestinationIp": "172.18.38.5", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H03133", "line": 3133, "raw_sha256": "2b4b15fe968af929d364aa179af22b882953dc87ab00e0468aa7fab0992974f6", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222707, "epoch": 1603355394.665, "event_time": "2020-10-22T08:29:54.665Z", "collection_time": "2020-10-22T08:29:58.691Z", "delay_seconds": 4.026, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53281, "destination_port": 49674, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.691Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:58", "UtcTime": "2020-10-22 08:29:54.665", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222707, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53281", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H16740", "line": 16740, "raw_sha256": "55e2a070ff9f3ab63e49a385ba8bf6b1a9bb2f6cf778a76da39f89b01f563772", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739570, "epoch": 1603355394.723, "event_time": "2020-10-22T08:29:54.723Z", "collection_time": "2020-10-22T08:30:21.429Z", "delay_seconds": 26.706, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61398, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.429Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.723", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739570, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61398", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16741", "line": 16741, "raw_sha256": "094009ac4dace06c5fc38cb61eefdf3d29e3b66b374ba16a46c69717a9151d05", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739571, "epoch": 1603355394.731, "event_time": "2020-10-22T08:29:54.731Z", "collection_time": "2020-10-22T08:30:21.429Z", "delay_seconds": 26.698, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61399, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.429Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.731", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739571, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61399", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16742", "line": 16742, "raw_sha256": "0fb701e8b9380e1316f5c550694ff4a95af3d0edc9b68abe8b7713c8016c2960", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739572, "epoch": 1603355394.738, "event_time": "2020-10-22T08:29:54.738Z", "collection_time": "2020-10-22T08:30:21.429Z", "delay_seconds": 26.691, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61400, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.429Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.738", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739572, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61400", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16743", "line": 16743, "raw_sha256": "4ee62b5d6765803b4904d69f45585bcb7efe7b82e9ada38252f8cdd7c6086820", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739573, "epoch": 1603355394.759, "event_time": "2020-10-22T08:29:54.759Z", "collection_time": "2020-10-22T08:30:21.430Z", "delay_seconds": 26.671, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.6", "destination_ip": "172.18.38.5", "source_port": 51850, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.430Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.759", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739573, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.6", "SourcePort": "51850", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16744", "line": 16744, "raw_sha256": "7cd163ad44b78385c08984fe6d446f19f924cccfb0a01a288982e97341ac64dc", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739574, "epoch": 1603355394.764, "event_time": "2020-10-22T08:29:54.764Z", "collection_time": "2020-10-22T08:30:21.431Z", "delay_seconds": 26.667, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.6", "destination_ip": "172.18.38.5", "source_port": 51851, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.431Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.764", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739574, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.6", "SourcePort": "51851", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H16745", "line": 16745, "raw_sha256": "fad7ba128fbd5c410c5a7f991bd55fee05975c2f7af890c7cb609148b2420764", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 739575, "epoch": 1603355394.777, "event_time": "2020-10-22T08:29:54.777Z", "collection_time": "2020-10-22T08:30:21.431Z", "delay_seconds": 26.654, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.6", "destination_ip": "172.18.38.5", "source_port": 51852, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:21.431Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:21", "UtcTime": "2020-10-22 08:29:54.777", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 739575, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.6", "SourcePort": "51852", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H03134", "line": 3134, "raw_sha256": "20f700ac5a68178b6eb91456bfbcc01d504a6e450b24239c505ead43d8bdf8b9", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222708, "epoch": 1603355394.779, "event_time": "2020-10-22T08:29:54.779Z", "collection_time": "2020-10-22T08:29:58.693Z", "delay_seconds": 3.914, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53282, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.693Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:58", "UtcTime": "2020-10-22 08:29:54.779", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222708, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53282", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H03135", "line": 3135, "raw_sha256": "8630fdbf51a561744654c0f3cf0cd461a00abbd8c273bd25e88965dfaa69db92", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222709, "epoch": 1603355394.783, "event_time": "2020-10-22T08:29:54.783Z", "collection_time": "2020-10-22T08:29:58.693Z", "delay_seconds": 3.91, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53283, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.693Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:58", "UtcTime": "2020-10-22 08:29:54.783", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222709, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53283", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H04533", "line": 4533, "raw_sha256": "c0747e4373a2693399f8939df646828debbb120e6e07de9fb540fb4d75bf51a5", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222990, "epoch": 1603355394.839, "event_time": "2020-10-22T08:29:54.839Z", "collection_time": "2020-10-22T08:30:00.181Z", "delay_seconds": 5.342, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53284, "destination_port": 49674, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.181Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:54.839", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222990, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{f3f7ca49-ba46-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53284", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H07306", "line": 7306, "raw_sha256": "7828823bc91d9e4cbccb0a1e20342a8d2bad84679475e4648820f747c24ef2fc", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 732515, "epoch": 1603355394.94, "event_time": "2020-10-22T08:29:54.940Z", "collection_time": "2020-10-22T08:30:07.621Z", "delay_seconds": 12.681, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4500, "session": "0x3e7", "guid": "{fddc55f3-4302-5f91-1506-000000000400}", "parent_guid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:07.621Z", "EventTime": "2020-10-22 04:29:54", "EventReceivedTime": "2020-10-22 04:30:02", "UtcTime": "2020-10-22 08:29:54.940", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 732515, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "CommandLine": "C:\\windows\\system32\\wbem\\wmiprvse.exe -Embedding", "ProcessId": "4500", "ProcessGuid": "{fddc55f3-4302-5f91-1506-000000000400}", "ParentProcessGuid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "920", "LogonId": "0x3e7" } }, { "id": "H19496", "line": 19496, "raw_sha256": "5d7dcb01996facc7b785239756ff022e5ace4a83b5de273cc639aa5edc574e2f", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 742316, "epoch": 1603355394.98, "event_time": "2020-10-22T08:29:54.980Z", "collection_time": "2020-10-22T08:30:27.680Z", "delay_seconds": 32.7, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58217, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:27.680Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:27", "UtcTime": "2020-10-22 08:29:54.980", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 742316, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58217", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H01310", "line": 1310, "raw_sha256": "c661217e6729caed04e0fb14e91710a40f6e74a2535eb422e3024ddda437c227", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation7.theshire.local", "record_number": 114397, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:55.532Z", "delay_seconds": 0.532, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x9b1ad0", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:55.532Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:55", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 114397, "ProcessId": "0x0", "TargetLogonId": "0x9b1ad0", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H02342", "line": 2342, "raw_sha256": "f3ff0515b1c39a40ad4b850477a00bcf0527241812ec5c88e8f4574b26a3731b", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537436, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.198Z", "delay_seconds": 2.198, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WORKSTATION7$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.198Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537436, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58209", "ServiceName": "WORKSTATION7$", "TicketEncryptionType": "0x12" } }, { "id": "H02389", "line": 2389, "raw_sha256": "2910d1901748b18a9e8247028437a54db9e6899ddb3c88f666aa484e4b4ded4e", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537440, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.224Z", "delay_seconds": 2.224, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WEC$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.224Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537440, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58212", "ServiceName": "WEC$", "TicketEncryptionType": "0x12" } }, { "id": "H02399", "line": 2399, "raw_sha256": "561462733b015d9f229237c297be59b31531132c466a643e7f0052164b6b193b", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537441, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.229Z", "delay_seconds": 2.229, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "MORDORDC$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.229Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537441, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58213", "ServiceName": "MORDORDC$", "TicketEncryptionType": "0x12" } }, { "id": "H02459", "line": 2459, "raw_sha256": "bf47423f15842c86c430b7d4e8e17bf03ae73779d2b65280e5ec1c78f079ede3", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation6.theshire.local", "record_number": 111490, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.261Z", "delay_seconds": 2.261, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x8fc6d5", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:57.261Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 111490, "ProcessId": "0x0", "TargetLogonId": "0x8fc6d5", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H02542", "line": 2542, "raw_sha256": "bdfa4a5f4987007150daed52f359977eee42132faa8743befc744bf863921ada", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537444, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.311Z", "delay_seconds": 2.311, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x2125fe4", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:57.311Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537444, "ProcessId": "0x0", "TargetLogonId": "0x2125fe4", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H02866", "line": 2866, "raw_sha256": "8a577d95dc414cb8d774ab97c1f34ad07c1f57c25bfdf55dbd2e3fd690520a83", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537469, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.529Z", "delay_seconds": 2.529, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\workstation7$", "target_account": "theshire.local\\workstation7$", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.7", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WORKSTATION7$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.529Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537469, "TargetUserName": "WORKSTATION7$@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.7", "IpPort": "61398", "ServiceName": "WORKSTATION7$", "TicketEncryptionType": "0x12" } }, { "id": "H02884", "line": 2884, "raw_sha256": "962070e81739d772a27aa63010747190f617bedb85f51289115fe4aa91e5f57d", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537471, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.543Z", "delay_seconds": 2.543, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "nt authority\\anonymous logon", "target_account": "nt authority\\anonymous logon", "caller_pid": 0, "session": "0x21271dc", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.7", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:57.543Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537471, "ProcessId": "0x0", "TargetLogonId": "0x21271dc", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "ANONYMOUS LOGON", "TargetDomainName": "NT AUTHORITY", "LogonType": "3", "IpAddress": "172.18.39.7", "IpPort": "61397" } }, { "id": "H02910", "line": 2910, "raw_sha256": "93806d56f67bed7476a6d1c2dbe361929335458a11f7e6806979f3b065a5e8d8", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537475, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.569Z", "delay_seconds": 2.569, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\workstation7$", "target_account": "theshire.local\\workstation7$", "caller_pid": 0, "session": "0x212722b", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.7", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:57.569Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537475, "ProcessId": "0x0", "TargetLogonId": "0x212722b", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "WORKSTATION7$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.7", "IpPort": "61400" } }, { "id": "H02927", "line": 2927, "raw_sha256": "34f8415fbf74c207938182da937d96e0105eb60f0dd1cc5bdfdff50ec156af89", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537478, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.579Z", "delay_seconds": 2.579, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\wec$", "target_account": "theshire.local\\wec$", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.38.6", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WEC$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.579Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537478, "TargetUserName": "WEC$@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.38.6", "IpPort": "51850", "ServiceName": "WEC$", "TicketEncryptionType": "0x12" } }, { "id": "H02937", "line": 2937, "raw_sha256": "2717009cb12af55c2fc5c0e0d5463837953a738f5ed390c42e9817da160be515", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537480, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.584Z", "delay_seconds": 2.584, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "nt authority\\anonymous logon", "target_account": "nt authority\\anonymous logon", "caller_pid": 0, "session": "0x212746d", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.38.6", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:57.584Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537480, "ProcessId": "0x0", "TargetLogonId": "0x212746d", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "ANONYMOUS LOGON", "TargetDomainName": "NT AUTHORITY", "LogonType": "3", "IpAddress": "172.18.38.6", "IpPort": "51849" } }, { "id": "H02957", "line": 2957, "raw_sha256": "5416a41cc1a1e755d1d6ec8ac71a9dbf13902348d849017f9bfa8d496bbd5931", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537484, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.594Z", "delay_seconds": 2.594, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\wec$", "target_account": "theshire.local\\wec$", "caller_pid": 0, "session": "0x212751e", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.38.6", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:57.594Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537484, "ProcessId": "0x0", "TargetLogonId": "0x212751e", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "WEC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.38.6", "IpPort": "51852" } }, { "id": "H02973", "line": 2973, "raw_sha256": "491897e9147986eeda4133a84452037c6b1171f72c475fa68fbd6d65adf72e46", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537488, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:57.603Z", "delay_seconds": 2.603, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.5", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WORKSTATION6$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.603Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:57", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537488, "TargetUserName": "pgustavo@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.5", "IpPort": "58217", "ServiceName": "WORKSTATION6$", "TicketEncryptionType": "0x12" } }, { "id": "H03093", "line": 3093, "raw_sha256": "de15ce10a29df11aac49abe50ddb281a0ae110680daf4cd25bb3352b86394214", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4769, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537520, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:58.667Z", "delay_seconds": 3.667, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\workstation6$", "target_account": "theshire.local\\workstation6$", "caller_pid": null, "session": null, "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.6", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": "0x0", "substatus": null, "encryption": "0x12", "service": "WORKSTATION6$", "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.667Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:58", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4769, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537520, "TargetUserName": "WORKSTATION6$@THESHIRE.LOCAL", "TargetDomainName": "THESHIRE.LOCAL", "Status": "0x0", "IpAddress": "::ffff:172.18.39.6", "IpPort": "53282", "ServiceName": "WORKSTATION6$", "TicketEncryptionType": "0x12" } }, { "id": "H03103", "line": 3103, "raw_sha256": "324fb30ea3c5967bb53d37e1f5b64b30283417e42772f520d1a725bb24224ae1", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537522, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:58.675Z", "delay_seconds": 3.675, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "nt authority\\anonymous logon", "target_account": "nt authority\\anonymous logon", "caller_pid": 0, "session": "0x212a214", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.6", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:58.675Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:58", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537522, "ProcessId": "0x0", "TargetLogonId": "0x212a214", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "ANONYMOUS LOGON", "TargetDomainName": "NT AUTHORITY", "LogonType": "3", "IpAddress": "172.18.39.6", "IpPort": "53281" } }, { "id": "H03233", "line": 3233, "raw_sha256": "4bd38fd3d4456b19eb6429a0bdf5ff9e240cf290f8ae582b3ff0c38faee516aa", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 537536, "epoch": 1603355395.0, "event_time": "2020-10-22T08:29:55.000Z", "collection_time": "2020-10-22T08:29:58.759Z", "delay_seconds": 3.759, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\workstation6$", "target_account": "theshire.local\\workstation6$", "caller_pid": 0, "session": "0x212b261", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "172.18.39.6", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:58.759Z", "EventTime": "2020-10-22 04:29:55", "EventReceivedTime": "2020-10-22 04:29:58", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 537536, "ProcessId": "0x0", "TargetLogonId": "0x212b261", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "WORKSTATION6$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "172.18.39.6", "IpPort": "53284" } }, { "id": "H19497", "line": 19497, "raw_sha256": "d8010e9b5d3ee24cacc7f2b5d51c60ad5f12fe14222f0b8405ee82291f479fe7", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 742317, "epoch": 1603355395.022, "event_time": "2020-10-22T08:29:55.022Z", "collection_time": "2020-10-22T08:30:27.680Z", "delay_seconds": 32.658, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.6", "source_port": 389, "destination_port": 57595, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:27.680Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:30:27", "UtcTime": "2020-10-22 08:29:55.022", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 742317, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "389", "DestinationIp": "172.18.39.6", "DestinationPort": "57595", "Protocol": "udp", "Initiated": "false" } }, { "id": "H02597", "line": 2597, "raw_sha256": "a587fed5030d725c6232dfc477110fd5d370999d06cdcf3f8f73434c16870016", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243761, "epoch": 1603355395.063, "event_time": "2020-10-22T08:29:55.063Z", "collection_time": "2020-10-22T08:29:57.341Z", "delay_seconds": 2.278, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58214, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.341Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:55.063", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243761, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58214", "DestinationIp": "172.18.39.7", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02599", "line": 2599, "raw_sha256": "2ebf827d4c56bbee63873f3a90f78bd6254c926521d7817dbf3b0cb3d93cbf6a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243762, "epoch": 1603355395.097, "event_time": "2020-10-22T08:29:55.097Z", "collection_time": "2020-10-22T08:29:57.342Z", "delay_seconds": 2.245, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 59755, "destination_port": 389, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.342Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:55.097", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243762, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "59755", "DestinationIp": "172.18.38.5", "DestinationPort": "389", "Protocol": "udp", "Initiated": "true" } }, { "id": "H22645", "line": 22645, "raw_sha256": "68b7d66f1b5584cc3d331cdec44751f7f07b74aff1ae16874f3f7eb7cf551708", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745259, "epoch": 1603355395.133, "event_time": "2020-10-22T08:29:55.133Z", "collection_time": "2020-10-22T08:30:35.182Z", "delay_seconds": 40.049, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\network service", "target_account": null, "caller_pid": 964, "session": null, "guid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\svchost.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53280, "destination_port": 135, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:35.182Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:35", "UtcTime": "2020-10-22 08:29:55.133", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745259, "User": "NT AUTHORITY\\NETWORK SERVICE", "Image": "C:\\Windows\\System32\\svchost.exe", "ProcessId": "964", "ProcessGuid": "{fddc55f3-b927-5f8f-0f00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53280", "DestinationIp": "172.18.38.5", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H22646", "line": 22646, "raw_sha256": "0868b0432bb4b9b38bf69a665f4f96ea7c1ef1dcc0f51b701d76d89ee7d06915", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745260, "epoch": 1603355395.137, "event_time": "2020-10-22T08:29:55.137Z", "collection_time": "2020-10-22T08:30:35.182Z", "delay_seconds": 40.045, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53281, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:35.182Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:35", "UtcTime": "2020-10-22 08:29:55.137", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745260, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53281", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H22647", "line": 22647, "raw_sha256": "d80b4906999bdf460fec6f287dc4fe5d630cdfab75942b0bac45bbebd51659f7", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745261, "epoch": 1603355395.138, "event_time": "2020-10-22T08:29:55.138Z", "collection_time": "2020-10-22T08:30:35.183Z", "delay_seconds": 40.045, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3512, "session": null, "guid": "{fddc55f3-b938-5f8f-5100-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\dns.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.6", "source_port": 53, "destination_port": 52283, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:35.183Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:35", "UtcTime": "2020-10-22 08:29:55.138", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745261, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dns.exe", "ProcessId": "3512", "ProcessGuid": "{fddc55f3-b938-5f8f-5100-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "53", "DestinationIp": "172.18.39.6", "DestinationPort": "52283", "Protocol": "udp", "Initiated": "false" } }, { "id": "H22648", "line": 22648, "raw_sha256": "5dc485286b086f7cf3dc131bf7fc55a09e751d63dc6225514ce23573c173df9f", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745262, "epoch": 1603355395.14, "event_time": "2020-10-22T08:29:55.140Z", "collection_time": "2020-10-22T08:30:35.183Z", "delay_seconds": 40.043, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.38.5", "destination_ip": "172.18.39.6", "source_port": 389, "destination_port": 52284, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:35.183Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:35", "UtcTime": "2020-10-22 08:29:55.140", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745262, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.38.5", "SourcePort": "389", "DestinationIp": "172.18.39.6", "DestinationPort": "52284", "Protocol": "udp", "Initiated": "false" } }, { "id": "H02601", "line": 2601, "raw_sha256": "155446f051d106547c94ef7e5ff5c189d67e9b857a234cf16c0822077a9aa0dc", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243763, "epoch": 1603355395.208, "event_time": "2020-10-22T08:29:55.208Z", "collection_time": "2020-10-22T08:29:57.343Z", "delay_seconds": 2.135, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61396, "destination_port": 135, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.343Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:55.208", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243763, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61396", "DestinationIp": "172.18.38.5", "DestinationPort": "135", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02602", "line": 2602, "raw_sha256": "9d2ee67031b77ff7cc2f21601891a6c07c467440172ff0811191283b5ed5ee3b", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243764, "epoch": 1603355395.211, "event_time": "2020-10-22T08:29:55.211Z", "collection_time": "2020-10-22T08:29:57.344Z", "delay_seconds": 2.133, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61397, "destination_port": 49674, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.344Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:55.211", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243764, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61397", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H22649", "line": 22649, "raw_sha256": "2a0d6c2a3517b034b72e9ae4addee6118f7fc28615c4973be4bdbc68e9dfac9e", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745263, "epoch": 1603355395.251, "event_time": "2020-10-22T08:29:55.251Z", "collection_time": "2020-10-22T08:30:35.183Z", "delay_seconds": 39.932, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53282, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:35.183Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:35", "UtcTime": "2020-10-22 08:29:55.251", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745263, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53282", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H22650", "line": 22650, "raw_sha256": "d6891cbe7619307837a1cc3c29d1ccbb3b7e4e2961aceedfa1ac1a5ca8b392b6", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745264, "epoch": 1603355395.255, "event_time": "2020-10-22T08:29:55.255Z", "collection_time": "2020-10-22T08:30:35.183Z", "delay_seconds": 39.928, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53283, "destination_port": 88, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:35.183Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:35", "UtcTime": "2020-10-22 08:29:55.255", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745264, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53283", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H22651", "line": 22651, "raw_sha256": "5216bb86ad01ab6f54836c191749adec38715ec4e6758bc32e26daa4b43c5eec", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745265, "epoch": 1603355395.311, "event_time": "2020-10-22T08:29:55.311Z", "collection_time": "2020-10-22T08:30:35.185Z", "delay_seconds": 39.874, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 696, "session": null, "guid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.6", "destination_ip": "172.18.38.5", "source_port": 53284, "destination_port": 49674, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:35.185Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:35", "UtcTime": "2020-10-22 08:29:55.311", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745265, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "696", "ProcessGuid": "{fddc55f3-b923-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.6", "SourcePort": "53284", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H02825", "line": 2825, "raw_sha256": "f03df765a3155bb08bdb928374ca11109cc122c6f74436b84b682c30607ce01c", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243844, "epoch": 1603355395.32, "event_time": "2020-10-22T08:29:55.320Z", "collection_time": "2020-10-22T08:29:57.497Z", "delay_seconds": 2.177, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61398, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.497Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:55.320", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243844, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61398", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02829", "line": 2829, "raw_sha256": "e63c295bada2ce8b61a5b11d07b7e630f14bdc60f445a33793188789ecf05e75", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243845, "epoch": 1603355395.327, "event_time": "2020-10-22T08:29:55.327Z", "collection_time": "2020-10-22T08:29:57.497Z", "delay_seconds": 2.17, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61399, "destination_port": 88, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.497Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:55.327", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243845, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61399", "DestinationIp": "172.18.38.5", "DestinationPort": "88", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02834", "line": 2834, "raw_sha256": "59c61c33b6328ecd7f3866074559ddff0c8e90f1ea6c0bfbe266db07abc0db0d", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243846, "epoch": 1603355395.334, "event_time": "2020-10-22T08:29:55.334Z", "collection_time": "2020-10-22T08:29:57.499Z", "delay_seconds": 2.165, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 720, "session": null, "guid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "parent_guid": "", "image": "C:\\Windows\\System32\\lsass.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.7", "destination_ip": "172.18.38.5", "source_port": 61400, "destination_port": 49674, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.499Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:55.334", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243846, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessId": "720", "ProcessGuid": "{4c9a7a20-ba45-5f8f-0c00-000000000400}", "SourceIp": "172.18.39.7", "SourcePort": "61400", "DestinationIp": "172.18.38.5", "DestinationPort": "49674", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02603", "line": 2603, "raw_sha256": "30a0ea80124e882350b3e76e71b4f492a670b02088ce8504538706e6dae972c1", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243765, "epoch": 1603355396.284, "event_time": "2020-10-22T08:29:56.284Z", "collection_time": "2020-10-22T08:29:57.345Z", "delay_seconds": 1.061, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 1532, "session": "0x3e7", "guid": "{4c9a7a20-4304-5f91-ce03-000000000400}", "parent_guid": "{4c9a7a20-ba46-5f8f-1000-000000000400}", "image": "C:\\Windows\\System32\\dllhost.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.345Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:56.284", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243765, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dllhost.exe", "CommandLine": "C:\\windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}", "ProcessId": "1532", "ProcessGuid": "{4c9a7a20-4304-5f91-ce03-000000000400}", "ParentProcessGuid": "{4c9a7a20-ba46-5f8f-1000-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "880", "LogonId": "0x3e7" } }, { "id": "H02694", "line": 2694, "raw_sha256": "d8cc244ed76dc05255aeaee989f8cb117158e44756e77504027bc99c4381a44a", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243810, "epoch": 1603355396.452, "event_time": "2020-10-22T08:29:56.452Z", "collection_time": "2020-10-22T08:29:57.395Z", "delay_seconds": 0.943, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 5240, "session": "0x3e7", "guid": "{4c9a7a20-4304-5f91-cf03-000000000400}", "parent_guid": "{4c9a7a20-ba5c-5f8f-7400-000000000400}", "image": "C:\\Windows\\System32\\SearchProtocolHost.exe", "parent_image": "C:\\Windows\\System32\\SearchIndexer.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.395Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:56.452", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243810, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\SearchProtocolHost.exe", "CommandLine": "\"C:\\windows\\system32\\SearchProtocolHost.exe\" Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 \"Software\\Microsoft\\Windows Search\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)\" \"C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\usgthrsvc\" \"DownLevelDaemon\" ", "ProcessId": "5240", "ProcessGuid": "{4c9a7a20-4304-5f91-cf03-000000000400}", "ParentProcessGuid": "{4c9a7a20-ba5c-5f8f-7400-000000000400}", "ParentImage": "C:\\Windows\\System32\\SearchIndexer.exe", "ParentProcessId": "804", "LogonId": "0x3e7" } }, { "id": "H02893", "line": 2893, "raw_sha256": "b65f831cdd395acd66e493c775be235fe6905c70e573bdeb2db7a7d22d3173b6", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243854, "epoch": 1603355396.574, "event_time": "2020-10-22T08:29:56.574Z", "collection_time": "2020-10-22T08:29:57.548Z", "delay_seconds": 0.974, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 2204, "session": "0x3e7", "guid": "{4c9a7a20-4304-5f91-d003-000000000400}", "parent_guid": "{4c9a7a20-ba5c-5f8f-7400-000000000400}", "image": "C:\\Windows\\System32\\SearchFilterHost.exe", "parent_image": "C:\\Windows\\System32\\SearchIndexer.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.548Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:56.574", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243854, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\SearchFilterHost.exe", "CommandLine": "\"C:\\windows\\system32\\SearchFilterHost.exe\" 0 768 772 780 8192 776 ", "ProcessId": "2204", "ProcessGuid": "{4c9a7a20-4304-5f91-d003-000000000400}", "ParentProcessGuid": "{4c9a7a20-ba5c-5f8f-7400-000000000400}", "ParentImage": "C:\\Windows\\System32\\SearchIndexer.exe", "ParentProcessId": "804", "LogonId": "0x3e7" } }, { "id": "H05867", "line": 5867, "raw_sha256": "901ab0e57765ad111684f33e36e73b1a6a014aa723d7965b67fee8c8a9140ed4", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 223321, "epoch": 1603355396.581, "event_time": "2020-10-22T08:29:56.581Z", "collection_time": "2020-10-22T08:30:06.850Z", "delay_seconds": 10.269, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58222, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:06.850Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:56.581", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 223321, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58222", "DestinationIp": "172.18.39.6", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H05038", "line": 5038, "raw_sha256": "caecd1c2df5bfb075e0ed7b7407d073b7588b082f54075ebfd5b39b4aa4ab33a", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388305, "epoch": 1603355396.583, "event_time": "2020-10-22T08:29:56.583Z", "collection_time": "2020-10-22T08:30:00.444Z", "delay_seconds": 3.861, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58222, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.444Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:56.583", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388305, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58222", "DestinationIp": "172.18.39.6", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H05041", "line": 5041, "raw_sha256": "1069d47694a508ac6c56ba2d32fa2ee13873bfc40c9752e5d42cbb49eec56b20", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388306, "epoch": 1603355396.625, "event_time": "2020-10-22T08:29:56.625Z", "collection_time": "2020-10-22T08:30:00.446Z", "delay_seconds": 3.821, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58223, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.446Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:56.625", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388306, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58223", "DestinationIp": "172.18.39.7", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H08699", "line": 8699, "raw_sha256": "ce86f6a45fd63f3226527dd8372f5b64964d95ba1a3d298e6c4bf920b5a36980", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 223521, "epoch": 1603355396.758, "event_time": "2020-10-22T08:29:56.758Z", "collection_time": "2020-10-22T08:30:08.165Z", "delay_seconds": 11.407, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58224, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:08.165Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:06", "UtcTime": "2020-10-22 08:29:56.758", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 223521, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{f3f7ca49-ba40-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58224", "DestinationIp": "172.18.39.6", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H05048", "line": 5048, "raw_sha256": "890a25b138ffe18ba58b63d958e5cd9439790073fa5d720b02a40e721142deaa", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388307, "epoch": 1603355396.76, "event_time": "2020-10-22T08:29:56.760Z", "collection_time": "2020-10-22T08:30:00.449Z", "delay_seconds": 3.689, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58224, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.449Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:56.760", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388307, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58224", "DestinationIp": "172.18.39.6", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H05052", "line": 5052, "raw_sha256": "0cbda7d7a47cf4690a4a4147d56aaa09e3c69333ff196e3c747915a96dd4cc6e", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388308, "epoch": 1603355396.793, "event_time": "2020-10-22T08:29:56.793Z", "collection_time": "2020-10-22T08:30:00.451Z", "delay_seconds": 3.658, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58225, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.451Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:56.793", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388308, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58225", "DestinationIp": "172.18.38.5", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H05058", "line": 5058, "raw_sha256": "f4ecbda61482acaa818ff5068c6d177fe3c39b6b762b8142326f9c2eaa45c84e", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388309, "epoch": 1603355396.86, "event_time": "2020-10-22T08:29:56.860Z", "collection_time": "2020-10-22T08:30:00.453Z", "delay_seconds": 3.593, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58226, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.453Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:56.860", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388309, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58226", "DestinationIp": "172.18.39.7", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H02870", "line": 2870, "raw_sha256": "fb23fd1683438225dcf7eed9b95ceb266101c1504a56d04c45d60e9935bbd145", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222662, "epoch": 1603355396.873, "event_time": "2020-10-22T08:29:56.873Z", "collection_time": "2020-10-22T08:29:57.531Z", "delay_seconds": 0.658, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3600, "session": "0x3e7", "guid": "{f3f7ca49-4304-5f91-4b02-000000000400}", "parent_guid": "{f3f7ca49-ba47-5f8f-1000-000000000400}", "image": "C:\\Windows\\System32\\dllhost.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:57.531Z", "EventTime": "2020-10-22 04:29:56", "EventReceivedTime": "2020-10-22 04:29:57", "UtcTime": "2020-10-22 08:29:56.873", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222662, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dllhost.exe", "CommandLine": "C:\\windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}", "ProcessId": "3600", "ProcessGuid": "{f3f7ca49-4304-5f91-4b02-000000000400}", "ParentProcessGuid": "{f3f7ca49-ba47-5f8f-1000-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "872", "LogonId": "0x3e7" } }, { "id": "H05063", "line": 5063, "raw_sha256": "6cf3b9d79e329d018087fd99b90a6b65d751ef49f813a58fc91ed4a820664203", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation5.theshire.local", "record_number": 388310, "epoch": 1603355396.946, "event_time": "2020-10-22T08:29:56.946Z", "collection_time": "2020-10-22T08:30:00.456Z", "delay_seconds": 3.51, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 7520, "session": null, "guid": "{313fa531-4300-5f91-ae04-000000000400}", "parent_guid": "", "image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58227, "destination_port": 5985, "initiated": true, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.456Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:56.946", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION5.theshire.local", "RecordNumber": 388310, "User": "THESHIRE\\pgustavo", "Image": "C:\\Users\\pgustavo\\Downloads\\PurpleSharp.exe", "ProcessId": "7520", "ProcessGuid": "{313fa531-4300-5f91-ae04-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58227", "DestinationIp": "172.18.38.5", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "true" } }, { "id": "H03636", "line": 3636, "raw_sha256": "03365a54046d23ed9b0681966221efb7d839931e0abdb91d7fa4d3277577b975", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation6.theshire.local", "record_number": 111632, "epoch": 1603355397.0, "event_time": "2020-10-22T08:29:57.000Z", "collection_time": "2020-10-22T08:29:59.015Z", "delay_seconds": 2.015, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x902dfb", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:59.015Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:59", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 111632, "ProcessId": "0x0", "TargetLogonId": "0x902dfb", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H03910", "line": 3910, "raw_sha256": "bb73967677a310bd105f2e9c9986e209bd5dbee9bebf044c359b0f22d13e51fc", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation7.theshire.local", "record_number": 114543, "epoch": 1603355397.0, "event_time": "2020-10-22T08:29:57.000Z", "collection_time": "2020-10-22T08:29:59.653Z", "delay_seconds": 2.653, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x9b9584", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:59.653Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:59", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 114543, "ProcessId": "0x0", "TargetLogonId": "0x9b9584", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H03968", "line": 3968, "raw_sha256": "fae0b885a3e17b746972b58f7b3a5a584215910ce7bfacdcc82b822c04db47a1", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation6.theshire.local", "record_number": 111657, "epoch": 1603355397.0, "event_time": "2020-10-22T08:29:57.000Z", "collection_time": "2020-10-22T08:29:59.743Z", "delay_seconds": 2.743, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x903e3d", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:59.743Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:59", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 111657, "ProcessId": "0x0", "TargetLogonId": "0x903e3d", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H04034", "line": 4034, "raw_sha256": "a3efcd9e2acba75008dcd644b5e91e429dcc375c203e73cc7bd548e3d3f733a2", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation7.theshire.local", "record_number": 114564, "epoch": 1603355397.0, "event_time": "2020-10-22T08:29:57.000Z", "collection_time": "2020-10-22T08:29:59.824Z", "delay_seconds": 2.824, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x9b9c7e", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:29:59.824Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:59", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 114564, "ProcessId": "0x0", "TargetLogonId": "0x9b9c7e", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H07373", "line": 7373, "raw_sha256": "fb5e45fd69da98c0731bcc8e7846d0c6cfdffde05543c9ac384f0e8646240af3", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538037, "epoch": 1603355397.0, "event_time": "2020-10-22T08:29:57.000Z", "collection_time": "2020-10-22T08:30:07.622Z", "delay_seconds": 10.622, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x2147594", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:07.622Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:02", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538037, "ProcessId": "0x0", "TargetLogonId": "0x2147594", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H03833", "line": 3833, "raw_sha256": "ea78f43fca1d2ec74c109816fb4b1105d8ff6e968737aa0917b510cca695ca1e", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 243943, "epoch": 1603355397.013, "event_time": "2020-10-22T08:29:57.013Z", "collection_time": "2020-10-22T08:29:59.583Z", "delay_seconds": 2.57, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 3804, "session": "0x9b1ad0", "guid": "{4c9a7a20-4305-5f91-d103-000000000400}", "parent_guid": "{4c9a7a20-ba46-5f8f-1000-000000000400}", "image": "C:\\Windows\\System32\\wsmprovhost.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:59.583Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:59", "UtcTime": "2020-10-22 08:29:57.013", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 243943, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\wsmprovhost.exe", "CommandLine": "C:\\windows\\system32\\wsmprovhost.exe -Embedding", "ProcessId": "3804", "ProcessGuid": "{4c9a7a20-4305-5f91-d103-000000000400}", "ParentProcessGuid": "{4c9a7a20-ba46-5f8f-1000-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "880", "LogonId": "0x9b1ad0" } }, { "id": "H03139", "line": 3139, "raw_sha256": "283b779027a8b8d13790bf1d88df38a532a8d55f6f7eb35eb63c873e8010976b", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222711, "epoch": 1603355397.026, "event_time": "2020-10-22T08:29:57.026Z", "collection_time": "2020-10-22T08:29:58.695Z", "delay_seconds": 1.669, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4884, "session": "0x3e7", "guid": "{f3f7ca49-4305-5f91-4c02-000000000400}", "parent_guid": "{f3f7ca49-bacf-5f8f-bf00-000000000400}", "image": "C:\\Windows\\System32\\SearchProtocolHost.exe", "parent_image": "C:\\Windows\\System32\\SearchIndexer.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.695Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:58", "UtcTime": "2020-10-22 08:29:57.026", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222711, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\SearchProtocolHost.exe", "CommandLine": "\"C:\\windows\\system32\\SearchProtocolHost.exe\" Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 \"Software\\Microsoft\\Windows Search\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)\" \"C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\usgthrsvc\" \"DownLevelDaemon\" ", "ProcessId": "4884", "ProcessGuid": "{f3f7ca49-4305-5f91-4c02-000000000400}", "ParentProcessGuid": "{f3f7ca49-bacf-5f8f-bf00-000000000400}", "ParentImage": "C:\\Windows\\System32\\SearchIndexer.exe", "ParentProcessId": "1360", "LogonId": "0x3e7" } }, { "id": "H03275", "line": 3275, "raw_sha256": "7fb1e275fabe7bb552953bb0e0c42a37aef26f1c457d76334d6c9a6fafe42b71", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222753, "epoch": 1603355397.134, "event_time": "2020-10-22T08:29:57.134Z", "collection_time": "2020-10-22T08:29:58.803Z", "delay_seconds": 1.669, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4036, "session": "0x3e7", "guid": "{f3f7ca49-4305-5f91-4d02-000000000400}", "parent_guid": "{f3f7ca49-bacf-5f8f-bf00-000000000400}", "image": "C:\\Windows\\System32\\SearchFilterHost.exe", "parent_image": "C:\\Windows\\System32\\SearchIndexer.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.803Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:58", "UtcTime": "2020-10-22 08:29:57.134", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222753, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\SearchFilterHost.exe", "CommandLine": "\"C:\\windows\\system32\\SearchFilterHost.exe\" 0 776 780 788 8192 784 ", "ProcessId": "4036", "ProcessGuid": "{f3f7ca49-4305-5f91-4d02-000000000400}", "ParentProcessGuid": "{f3f7ca49-bacf-5f8f-bf00-000000000400}", "ParentImage": "C:\\Windows\\System32\\SearchIndexer.exe", "ParentProcessId": "1360", "LogonId": "0x3e7" } }, { "id": "H23271", "line": 23271, "raw_sha256": "39874013b9f8127c21eed8c8739022e4edbde70683475d6925f6ef5b62ce762f", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 745885, "epoch": 1603355397.183, "event_time": "2020-10-22T08:29:57.183Z", "collection_time": "2020-10-22T08:30:36.490Z", "delay_seconds": 39.307, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 5456, "session": "0x3e7", "guid": "{fddc55f3-4305-5f91-1606-000000000400}", "parent_guid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "image": "C:\\Windows\\System32\\dllhost.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:36.490Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:36", "UtcTime": "2020-10-22 08:29:57.183", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 745885, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\dllhost.exe", "CommandLine": "C:\\windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}", "ProcessId": "5456", "ProcessGuid": "{fddc55f3-4305-5f91-1606-000000000400}", "ParentProcessGuid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "920", "LogonId": "0x3e7" } }, { "id": "H24431", "line": 24431, "raw_sha256": "7ab1706665d6d75c4cb685a4b0b05d322e208c0f3fac50b8ea692317aa4962d6", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 747003, "epoch": 1603355397.263, "event_time": "2020-10-22T08:29:57.263Z", "collection_time": "2020-10-22T08:30:39.091Z", "delay_seconds": 41.828, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58225, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:39.091Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:39", "UtcTime": "2020-10-22 08:29:57.263", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 747003, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58225", "DestinationIp": "172.18.38.5", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H24432", "line": 24432, "raw_sha256": "60ac2ea4fd4c606e5d23039c6f8fb516531b9cd27ac471c9748115f05f1af436", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 747004, "epoch": 1603355397.415, "event_time": "2020-10-22T08:29:57.415Z", "collection_time": "2020-10-22T08:30:39.093Z", "delay_seconds": 41.678, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58227, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:39.093Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:39", "UtcTime": "2020-10-22 08:29:57.415", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 747004, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{fddc55f3-b91c-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58227", "DestinationIp": "172.18.38.5", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H03601", "line": 3601, "raw_sha256": "c64a67fa4a097e1041b346a0aaac973e3f7ac9622e36d0e3676ea9ada345dc7b", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222847, "epoch": 1603355397.518, "event_time": "2020-10-22T08:29:57.518Z", "collection_time": "2020-10-22T08:29:58.970Z", "delay_seconds": 1.452, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 4816, "session": "0x8fc6d5", "guid": "{f3f7ca49-4305-5f91-4e02-000000000400}", "parent_guid": "{f3f7ca49-ba47-5f8f-1000-000000000400}", "image": "C:\\Windows\\System32\\wsmprovhost.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:29:58.970Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:29:58", "UtcTime": "2020-10-22 08:29:57.518", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222847, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\wsmprovhost.exe", "CommandLine": "C:\\windows\\system32\\wsmprovhost.exe -Embedding", "ProcessId": "4816", "ProcessGuid": "{f3f7ca49-4305-5f91-4e02-000000000400}", "ParentProcessGuid": "{f3f7ca49-ba47-5f8f-1000-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "872", "LogonId": "0x8fc6d5" } }, { "id": "H23781", "line": 23781, "raw_sha256": "ca7efd915acce8cecda52d45af98d0fd5a8d8754a9617fba922c0f7480d2611e", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 746395, "epoch": 1603355397.653, "event_time": "2020-10-22T08:29:57.653Z", "collection_time": "2020-10-22T08:30:37.757Z", "delay_seconds": 40.104, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 996, "session": "0x2125fe4", "guid": "{fddc55f3-4305-5f91-1706-000000000400}", "parent_guid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "image": "C:\\Windows\\System32\\wsmprovhost.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:37.757Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:37", "UtcTime": "2020-10-22 08:29:57.653", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 746395, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\wsmprovhost.exe", "CommandLine": "C:\\windows\\system32\\wsmprovhost.exe -Embedding", "ProcessId": "996", "ProcessGuid": "{fddc55f3-4305-5f91-1706-000000000400}", "ParentProcessGuid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "920", "LogonId": "0x2125fe4" } }, { "id": "H09351", "line": 9351, "raw_sha256": "da0f8d9f578cb3db1f19cd5cf552ad7d4d886bdce6f5216fa35c5c74468ca8c8", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 244877, "epoch": 1603355397.691, "event_time": "2020-10-22T08:29:57.691Z", "collection_time": "2020-10-22T08:30:08.687Z", "delay_seconds": 10.996, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58223, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:08.687Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:07", "UtcTime": "2020-10-22 08:29:57.691", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 244877, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58223", "DestinationIp": "172.18.39.7", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H23911", "line": 23911, "raw_sha256": "0b2841929cf47c84086c99552149056e5c2c205c85c767cc0b907c2a91d91f18", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 746525, "epoch": 1603355397.802, "event_time": "2020-10-22T08:29:57.802Z", "collection_time": "2020-10-22T08:30:37.829Z", "delay_seconds": 40.027, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\network service", "target_account": null, "caller_pid": 1872, "session": "0x3e4", "guid": "{fddc55f3-4305-5f91-1806-000000000400}", "parent_guid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "parent_image": "C:\\Windows\\System32\\svchost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:37.829Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:37", "UtcTime": "2020-10-22 08:29:57.802", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 746525, "User": "NT AUTHORITY\\NETWORK SERVICE", "Image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "CommandLine": "C:\\windows\\system32\\wbem\\wmiprvse.exe -Embedding", "ProcessId": "1872", "ProcessGuid": "{fddc55f3-4305-5f91-1806-000000000400}", "ParentProcessGuid": "{fddc55f3-b927-5f8f-0e00-000000000400}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentProcessId": "920", "LogonId": "0x3e4" } }, { "id": "H10117", "line": 10117, "raw_sha256": "c5263fe1a7b09f2d801149c82e57dd7820f023e58516a245b9098ecca834e89b", "provider": "Microsoft-Windows-Sysmon", "event_id": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 245139, "epoch": 1603355397.926, "event_time": "2020-10-22T08:29:57.926Z", "collection_time": "2020-10-22T08:30:08.906Z", "delay_seconds": 10.98, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 4, "session": null, "guid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "parent_guid": "", "image": "System", "parent_image": "", "client_ip": null, "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58226, "destination_port": 5985, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:08.906Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:07", "UtcTime": "2020-10-22 08:29:57.926", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 3, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 245139, "User": "NT AUTHORITY\\SYSTEM", "Image": "System", "ProcessId": "4", "ProcessGuid": "{4c9a7a20-ba3f-5f8f-0100-000000000400}", "SourceIp": "172.18.39.5", "SourcePort": "58226", "DestinationIp": "172.18.39.7", "DestinationPort": "5985", "Protocol": "tcp", "Initiated": "false" } }, { "id": "H04447", "line": 4447, "raw_sha256": "485108b18744d869fbba4d1af5f603a86b2d8d2deebc03b4d957a453a5c0cb13", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 222980, "epoch": 1603355397.967, "event_time": "2020-10-22T08:29:57.967Z", "collection_time": "2020-10-22T08:30:00.116Z", "delay_seconds": 2.149, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 4952, "session": "0x8fc6d5", "guid": "{f3f7ca49-4305-5f91-4f02-000000000400}", "parent_guid": "{f3f7ca49-4305-5f91-4e02-000000000400}", "image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "parent_image": "C:\\Windows\\System32\\wsmprovhost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.116Z", "EventTime": "2020-10-22 04:29:57", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:57.967", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 222980, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "CommandLine": "\"C:\\windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", "ProcessId": "4952", "ProcessGuid": "{f3f7ca49-4305-5f91-4f02-000000000400}", "ParentProcessGuid": "{f3f7ca49-4305-5f91-4e02-000000000400}", "ParentImage": "C:\\Windows\\System32\\wsmprovhost.exe", "ParentProcessId": "4816", "LogonId": "0x8fc6d5" } }, { "id": "H07407", "line": 7407, "raw_sha256": "d5e34c99a71463005f2fa7c20bb757d5d84301dc0d7f88cb3c885aa1b22ffc49", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538070, "epoch": 1603355398.0, "event_time": "2020-10-22T08:29:58.000Z", "collection_time": "2020-10-22T08:30:07.623Z", "delay_seconds": 9.623, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x214829b", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:07.623Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:02", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538070, "ProcessId": "0x0", "TargetLogonId": "0x214829b", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H04352", "line": 4352, "raw_sha256": "828d46c798c61c769376feeeb7d34829f5c7e4bc9ff438c972da1817976b5c09", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 244058, "epoch": 1603355398.036, "event_time": "2020-10-22T08:29:58.036Z", "collection_time": "2020-10-22T08:30:00.074Z", "delay_seconds": 2.038, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 3932, "session": "0x9b1ad0", "guid": "{4c9a7a20-4306-5f91-d203-000000000400}", "parent_guid": "{4c9a7a20-4305-5f91-d103-000000000400}", "image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "parent_image": "C:\\Windows\\System32\\wsmprovhost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.074Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:58.036", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 244058, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "CommandLine": "\"C:\\windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", "ProcessId": "3932", "ProcessGuid": "{4c9a7a20-4306-5f91-d203-000000000400}", "ParentProcessGuid": "{4c9a7a20-4305-5f91-d103-000000000400}", "ParentImage": "C:\\Windows\\System32\\wsmprovhost.exe", "ParentProcessId": "3804", "LogonId": "0x9b1ad0" } }, { "id": "H24051", "line": 24051, "raw_sha256": "75cf6352af3feac974a999d2c10f5bdd8d56785fab947f9cbffd66a87b7d3927", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 746665, "epoch": 1603355398.095, "event_time": "2020-10-22T08:29:58.095Z", "collection_time": "2020-10-22T08:30:37.907Z", "delay_seconds": 39.812, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 5384, "session": "0x2125fe4", "guid": "{fddc55f3-4306-5f91-1906-000000000400}", "parent_guid": "{fddc55f3-4305-5f91-1706-000000000400}", "image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "parent_image": "C:\\Windows\\System32\\wsmprovhost.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:37.907Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:37", "UtcTime": "2020-10-22 08:29:58.095", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 746665, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "CommandLine": "\"C:\\windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", "ProcessId": "5384", "ProcessGuid": "{fddc55f3-4306-5f91-1906-000000000400}", "ParentProcessGuid": "{fddc55f3-4305-5f91-1706-000000000400}", "ParentImage": "C:\\Windows\\System32\\wsmprovhost.exe", "ParentProcessId": "996", "LogonId": "0x2125fe4" } }, { "id": "H24058", "line": 24058, "raw_sha256": "3b4e6a480a69dc9bc88501ae3ce5f312264305654a01f9fde0dd3f0486ff8021", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "mordordc.theshire.local", "record_number": 746672, "epoch": 1603355398.113, "event_time": "2020-10-22T08:29:58.113Z", "collection_time": "2020-10-22T08:30:37.912Z", "delay_seconds": 39.799, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 2060, "session": "0x2125fe4", "guid": "{fddc55f3-4306-5f91-1a06-000000000400}", "parent_guid": "{fddc55f3-4306-5f91-1906-000000000400}", "image": "C:\\Windows\\System32\\conhost.exe", "parent_image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:37.912Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:37", "UtcTime": "2020-10-22 08:29:58.113", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 746672, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\conhost.exe", "CommandLine": "\\??\\C:\\windows\\system32\\conhost.exe 0xffffffff -ForceV1", "ProcessId": "2060", "ProcessGuid": "{fddc55f3-4306-5f91-1a06-000000000400}", "ParentProcessGuid": "{fddc55f3-4306-5f91-1906-000000000400}", "ParentImage": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "ParentProcessId": "5384", "LogonId": "0x2125fe4" } }, { "id": "H05179", "line": 5179, "raw_sha256": "fd1ce1402c3b3d644ae08e4a3b21452467cd4b6a704b7946046112f651fbd4ad", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 244240, "epoch": 1603355398.21, "event_time": "2020-10-22T08:29:58.210Z", "collection_time": "2020-10-22T08:30:00.526Z", "delay_seconds": 2.316, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 692, "session": "0x9b1ad0", "guid": "{4c9a7a20-4306-5f91-d303-000000000400}", "parent_guid": "{4c9a7a20-4306-5f91-d203-000000000400}", "image": "C:\\Windows\\System32\\conhost.exe", "parent_image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:00.526Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:58.210", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 244240, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\conhost.exe", "CommandLine": "\\??\\C:\\windows\\system32\\conhost.exe 0xffffffff -ForceV1", "ProcessId": "692", "ProcessGuid": "{4c9a7a20-4306-5f91-d303-000000000400}", "ParentProcessGuid": "{4c9a7a20-4306-5f91-d203-000000000400}", "ParentImage": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "ParentProcessId": "3932", "LogonId": "0x9b1ad0" } }, { "id": "H05406", "line": 5406, "raw_sha256": "dc7a74b14d0ca1026d35e58c3ba3323ca81a283c1d983a02bf5e3dcfc9eea9d5", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 223180, "epoch": 1603355398.601, "event_time": "2020-10-22T08:29:58.601Z", "collection_time": "2020-10-22T08:30:06.613Z", "delay_seconds": 8.012, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "theshire.local\\pgustavo", "target_account": null, "caller_pid": 3696, "session": "0x8fc6d5", "guid": "{f3f7ca49-4306-5f91-5002-000000000400}", "parent_guid": "{f3f7ca49-4305-5f91-4f02-000000000400}", "image": "C:\\Windows\\System32\\conhost.exe", "parent_image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:06.613Z", "EventTime": "2020-10-22 04:29:58", "EventReceivedTime": "2020-10-22 04:30:00", "UtcTime": "2020-10-22 08:29:58.601", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 223180, "User": "THESHIRE\\pgustavo", "Image": "C:\\Windows\\System32\\conhost.exe", "CommandLine": "\\??\\C:\\windows\\system32\\conhost.exe 0xffffffff -ForceV1", "ProcessId": "3696", "ProcessGuid": "{f3f7ca49-4306-5f91-5002-000000000400}", "ParentProcessGuid": "{f3f7ca49-4305-5f91-4f02-000000000400}", "ParentImage": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "ParentProcessId": "4952", "LogonId": "0x8fc6d5" } }, { "id": "H06057", "line": 6057, "raw_sha256": "011697916a7671d4820d3cbcfbeb50cfa405b038ace846c12848a3a1a913e380", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation7.theshire.local", "record_number": 114816, "epoch": 1603355399.0, "event_time": "2020-10-22T08:29:59.000Z", "collection_time": "2020-10-22T08:30:06.852Z", "delay_seconds": 7.852, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x9c0b19", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:06.852Z", "EventTime": "2020-10-22 04:29:59", "EventReceivedTime": "2020-10-22 04:30:01", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 114816, "ProcessId": "0x0", "TargetLogonId": "0x9c0b19", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H06694", "line": 6694, "raw_sha256": "5799cd6ea0fdc7c5800935ec741d4034a753ab6ed68925ace91fa6501fbee2b1", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "workstation6.theshire.local", "record_number": 111911, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:07.114Z", "delay_seconds": 7.114, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x90b73a", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:07.114Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:02", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 111911, "ProcessId": "0x0", "TargetLogonId": "0x90b73a", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08382", "line": 8382, "raw_sha256": "3db4d9882a5a8d7cd00ae5bc2f877b6e9ce98f2ee129b3395084d410df039841", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538506, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.161Z", "delay_seconds": 8.161, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2152757", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.161Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:04", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538506, "ProcessId": "0x0", "TargetLogonId": "0x2152757", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08390", "line": 8390, "raw_sha256": "d0c29aa6dbbd07ab36e119edfc5d5186c299c54444ef74462520bbdb3e0309a3", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538514, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.162Z", "delay_seconds": 8.162, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2152aac", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.162Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:04", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538514, "ProcessId": "0x0", "TargetLogonId": "0x2152aac", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08396", "line": 8396, "raw_sha256": "20ddc2b531bdb25a9ded3fcea5c40d954a091dfc38c8050991ef8337d136d490", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538520, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.162Z", "delay_seconds": 8.162, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2152dbe", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.162Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:04", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538520, "ProcessId": "0x0", "TargetLogonId": "0x2152dbe", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08402", "line": 8402, "raw_sha256": "67c14a4e27de3a23a4eddc08ceadefac368f2ed364571c73f4c8817e030466f3", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538526, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.162Z", "delay_seconds": 8.162, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2152f71", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.162Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:04", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538526, "ProcessId": "0x0", "TargetLogonId": "0x2152f71", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08405", "line": 8405, "raw_sha256": "805843b53bb9aa426cc0507d7317eef0a7f5fc8c18d0a3f0c763a46bd00e98fa", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538529, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.162Z", "delay_seconds": 8.162, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2153107", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.162Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:04", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538529, "ProcessId": "0x0", "TargetLogonId": "0x2153107", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08411", "line": 8411, "raw_sha256": "cb45a3f8bbc6a453ed69785a23f52b2d250bbf39359ce361f909cc4f90ca3788", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538535, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.162Z", "delay_seconds": 8.162, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2153145", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.162Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:04", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538535, "ProcessId": "0x0", "TargetLogonId": "0x2153145", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08414", "line": 8414, "raw_sha256": "e29479e3598b47e951532fd5e9fd9b76d6edc8e47bcf4b216ea668b0bbe48c8e", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538538, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.162Z", "delay_seconds": 8.162, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2153194", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.162Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:04", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538538, "ProcessId": "0x0", "TargetLogonId": "0x2153194", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08452", "line": 8452, "raw_sha256": "705c5fe463167e8aa0fc376a403729a1774af02a78e73738042a19aa543ce5fb", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538541, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.162Z", "delay_seconds": 8.162, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x21531cc", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.162Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538541, "ProcessId": "0x0", "TargetLogonId": "0x21531cc", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08455", "line": 8455, "raw_sha256": "77ea458a6eced6549738e7b8f61c5c6a0d25a4931f08ca88becaa7fbc6fb6416", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538544, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.163Z", "delay_seconds": 8.163, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215322b", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.163Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538544, "ProcessId": "0x0", "TargetLogonId": "0x215322b", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08466", "line": 8466, "raw_sha256": "05d21a25d8894a76ccc41e634385cca1f0fa11b116aa54933bde33c4f4470e60", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538555, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.163Z", "delay_seconds": 8.163, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x21532f5", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.163Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538555, "ProcessId": "0x0", "TargetLogonId": "0x21532f5", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08469", "line": 8469, "raw_sha256": "96ffe7172eaba876f4442e2af005493014f522b47b798049adeaa50ee0b2b346", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538558, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.163Z", "delay_seconds": 8.163, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2153344", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.163Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538558, "ProcessId": "0x0", "TargetLogonId": "0x2153344", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08472", "line": 8472, "raw_sha256": "281f3a29d292a6294a92f69d4d85f3ca22eb029f574dcf26bd7a5c8d40670d60", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538561, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.163Z", "delay_seconds": 8.163, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x2153393", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.163Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538561, "ProcessId": "0x0", "TargetLogonId": "0x2153393", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08475", "line": 8475, "raw_sha256": "abfca632af959ef1f886caaa86bf9b14e38776780efdf903c417a3a4c94bcb1f", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538564, "epoch": 1603355400.0, "event_time": "2020-10-22T08:30:00.000Z", "collection_time": "2020-10-22T08:30:08.163Z", "delay_seconds": 8.163, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x21533cd", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.163Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538564, "ProcessId": "0x0", "TargetLogonId": "0x21533cd", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H10560", "line": 10560, "raw_sha256": "26bafca274ac2180efb0f962e27155f6ab60a8ec4efe80208f6ec381c5d17329", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation7.theshire.local", "record_number": 245290, "epoch": 1603355400.017, "event_time": "2020-10-22T08:30:00.017Z", "collection_time": "2020-10-22T08:30:09.155Z", "delay_seconds": 9.138, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 3092, "session": "0x3e7", "guid": "{4c9a7a20-4308-5f91-d403-000000000400}", "parent_guid": "{4c9a7a20-ba45-5f8f-0b00-000000000400}", "image": "C:\\Windows\\System32\\svchost.exe", "parent_image": "C:\\Windows\\System32\\services.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:09.155Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:07", "UtcTime": "2020-10-22 08:30:00.017", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION7.theshire.local", "RecordNumber": 245290, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\svchost.exe", "CommandLine": "C:\\windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc", "ProcessId": "3092", "ProcessGuid": "{4c9a7a20-4308-5f91-d403-000000000400}", "ParentProcessGuid": "{4c9a7a20-ba45-5f8f-0b00-000000000400}", "ParentImage": "C:\\Windows\\System32\\services.exe", "ParentProcessId": "712", "LogonId": "0x3e7" } }, { "id": "H10786", "line": 10786, "raw_sha256": "b27e5e224712925708e6080cdcdb74e2d9db4fbb0ddec902c045f89814da7f15", "provider": "Microsoft-Windows-Sysmon", "event_id": 1, "channel": "Microsoft-Windows-Sysmon/Operational", "host": "workstation6.theshire.local", "record_number": 224202, "epoch": 1603355400.461, "event_time": "2020-10-22T08:30:00.461Z", "collection_time": "2020-10-22T08:30:09.158Z", "delay_seconds": 8.697, "clock_basis": "Sysmon UtcTime (UTC)", "time_precision": "millisecond", "actor": "nt authority\\system", "target_account": null, "caller_pid": 5112, "session": "0x3e7", "guid": "{f3f7ca49-4308-5f91-5102-000000000400}", "parent_guid": "{f3f7ca49-ba46-5f8f-0b00-000000000400}", "image": "C:\\Windows\\System32\\svchost.exe", "parent_image": "C:\\Windows\\System32\\services.exe", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": null, "raw": { "@timestamp": "2020-10-22T08:30:09.158Z", "EventTime": "2020-10-22 04:30:00", "EventReceivedTime": "2020-10-22 04:30:07", "UtcTime": "2020-10-22 08:30:00.461", "SourceName": "Microsoft-Windows-Sysmon", "EventID": 1, "Channel": "Microsoft-Windows-Sysmon/Operational", "Hostname": "WORKSTATION6.theshire.local", "RecordNumber": 224202, "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\System32\\svchost.exe", "CommandLine": "C:\\windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc", "ProcessId": "5112", "ProcessGuid": "{f3f7ca49-4308-5f91-5102-000000000400}", "ParentProcessGuid": "{f3f7ca49-ba46-5f8f-0b00-000000000400}", "ParentImage": "C:\\Windows\\System32\\services.exe", "ParentProcessId": "712", "LogonId": "0x3e7" } }, { "id": "H08489", "line": 8489, "raw_sha256": "979b3d619ac8658c12c1e331271ecdd29fcb7a4e53038770d615690d05ddee77", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538578, "epoch": 1603355401.0, "event_time": "2020-10-22T08:30:01.000Z", "collection_time": "2020-10-22T08:30:08.163Z", "delay_seconds": 7.163, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\pgustavo", "target_account": "theshire.local\\pgustavo", "caller_pid": 0, "session": "0x2153bd3", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.163Z", "EventTime": "2020-10-22 04:30:01", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538578, "ProcessId": "0x0", "TargetLogonId": "0x2153bd3", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "pgustavo", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08656", "line": 8656, "raw_sha256": "fb91e3fefe455d722f3fdcd7e1b869482180d304abd91c7e7e5639c030b3f2a1", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538647, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.165Z", "delay_seconds": 5.165, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d22d", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.165Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538647, "ProcessId": "0x0", "TargetLogonId": "0x215d22d", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08742", "line": 8742, "raw_sha256": "d28d0e3508f68f5aea248bbb66e5d504fb845c903d486e0c37d0cb06485f5978", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538658, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.166Z", "delay_seconds": 5.166, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d309", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.166Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538658, "ProcessId": "0x0", "TargetLogonId": "0x215d309", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08754", "line": 8754, "raw_sha256": "687c04cc7b399735f145254dbd96d27774afc9bd5400214e50fadd5e20ddd015", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538661, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.166Z", "delay_seconds": 5.166, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d355", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.166Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538661, "ProcessId": "0x0", "TargetLogonId": "0x215d355", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08765", "line": 8765, "raw_sha256": "e604d8dbfc86d37ffbc2a75cb391a44b21faf9b144f9384fc6e762d5ae7e1383", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538664, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.166Z", "delay_seconds": 5.166, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d3b5", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.166Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538664, "ProcessId": "0x0", "TargetLogonId": "0x215d3b5", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08777", "line": 8777, "raw_sha256": "446307befde4e5e27165d38b91ebb000fb630611ffb4bdd522c21db46b8e4b2e", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538667, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.166Z", "delay_seconds": 5.166, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d409", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.166Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538667, "ProcessId": "0x0", "TargetLogonId": "0x215d409", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08789", "line": 8789, "raw_sha256": "ecd5be829097b6a6003bdc4f9eda94e9b62915650fbd7be6e15869bf4d817467", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538670, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.166Z", "delay_seconds": 5.166, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d467", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.166Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538670, "ProcessId": "0x0", "TargetLogonId": "0x215d467", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08802", "line": 8802, "raw_sha256": "5e7b5bae70467127fed8466d1206da1c835b6547bf0a02652e1ab09b0cc47a5e", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538673, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.378Z", "delay_seconds": 5.378, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d4c9", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.378Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538673, "ProcessId": "0x0", "TargetLogonId": "0x215d4c9", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08814", "line": 8814, "raw_sha256": "b3da45695c11e7330e796a3de7d173aa366b1c7baf4eb432ad3f4d950663ecec", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538676, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.379Z", "delay_seconds": 5.379, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d52c", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.379Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538676, "ProcessId": "0x0", "TargetLogonId": "0x215d52c", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08826", "line": 8826, "raw_sha256": "abc91cef8f7159427f4c099dc19163da0fdbeaf3f96d802c28bd7879a27ff57a", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538679, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.379Z", "delay_seconds": 5.379, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d58a", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.379Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538679, "ProcessId": "0x0", "TargetLogonId": "0x215d58a", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H08839", "line": 8839, "raw_sha256": "ea9efdf54bbf4c3a3ade94e03b6efd84a847fff4e0f7092b6abdd8a333c89526", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538682, "epoch": 1603355403.0, "event_time": "2020-10-22T08:30:03.000Z", "collection_time": "2020-10-22T08:30:08.379Z", "delay_seconds": 5.379, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x215d5d1", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": null, "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:08.379Z", "EventTime": "2020-10-22 04:30:03", "EventReceivedTime": "2020-10-22 04:30:06", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538682, "ProcessId": "0x0", "TargetLogonId": "0x215d5d1", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "-", "IpPort": "-" } }, { "id": "H22596", "line": 22596, "raw_sha256": "e5ceec93bbcaddc829377e05c125b0d3e4b8590c2a8e45f7e0342ef2ebfb9703", "provider": "Microsoft-Windows-Security-Auditing", "event_id": 4624, "channel": "Security", "host": "mordordc.theshire.local", "record_number": 538702, "epoch": 1603355433.0, "event_time": "2020-10-22T08:30:33.000Z", "collection_time": "2020-10-22T08:30:34.153Z", "delay_seconds": 1.153, "clock_basis": "EventTime + capture UTC-04:00 (inferred)", "time_precision": "second", "actor": "theshire.local\\mordordc$", "target_account": "theshire.local\\mordordc$", "caller_pid": 0, "session": "0x216e021", "guid": "", "parent_guid": "", "image": "", "parent_image": "", "client_ip": "::1", "source_ip": null, "destination_ip": null, "source_port": null, "destination_port": null, "initiated": false, "status": null, "substatus": null, "encryption": null, "service": null, "share": "", "share_target": "", "logon_type": 3, "raw": { "@timestamp": "2020-10-22T08:30:34.153Z", "EventTime": "2020-10-22 04:30:33", "EventReceivedTime": "2020-10-22 04:30:34", "SourceName": "Microsoft-Windows-Security-Auditing", "EventID": 4624, "Channel": "Security", "Hostname": "MORDORDC.theshire.local", "RecordNumber": 538702, "ProcessId": "0x0", "TargetLogonId": "0x216e021", "SubjectLogonId": "0x0", "SubjectUserName": "-", "SubjectDomainName": "-", "TargetUserName": "MORDORDC$", "TargetDomainName": "THESHIRE.LOCAL", "LogonType": "3", "IpAddress": "::1", "IpPort": "53121" } } ], "packets": [ { "id": "P00839", "packet_number": 839, "byte_offset": 545534, "frame_sha256": "0c105253acc3ad72eaf0cecb57272798b020c9930c01eddd79804d1af1fb5c46", "epoch": 1603355395.135171, "event_time": "2020-10-22T08:29:55.135Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58214, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00843", "packet_number": 843, "byte_offset": 552142, "frame_sha256": "365774aa88c63fd3f3802e3c955e83e0217fe46edcffce38556c50e412ac3794", "epoch": 1603355395.145116, "event_time": "2020-10-22T08:29:55.145Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58215, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00872", "packet_number": 872, "byte_offset": 566552, "frame_sha256": "599057bae7175275c2376fdfeac6deba56e4e4aec8ad3989350ebd25dd62a1ab", "epoch": 1603355395.652438, "event_time": "2020-10-22T08:29:55.652Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58218, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00884", "packet_number": 884, "byte_offset": 579064, "frame_sha256": "bea7483335c3160add431da0be29e8c8b4a91f36f8279d5f96a77deb770d7619", "epoch": 1603355397.719107, "event_time": "2020-10-22T08:29:57.719Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58222, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00896", "packet_number": 896, "byte_offset": 587864, "frame_sha256": "6172aaf1d9d8adbbfa39de523bd7c062027e688984680c6a307fe36ce5f76e91", "epoch": 1603355397.793274, "event_time": "2020-10-22T08:29:57.793Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58223, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00902", "packet_number": 902, "byte_offset": 593351, "frame_sha256": "6db04ae3bfa257ba17ac5dd788bcab2a81821149188c5a93b688af47bcbfa55f", "epoch": 1603355397.854225, "event_time": "2020-10-22T08:29:57.854Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58222, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00908", "packet_number": 908, "byte_offset": 597635, "frame_sha256": "09f81b05e3eacec6e9b18d0cb940ba8cff0014936c0b17aa602632ab8edd605f", "epoch": 1603355397.862076, "event_time": "2020-10-22T08:29:57.862Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58222, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00911", "packet_number": 911, "byte_offset": 600120, "frame_sha256": "da10c3f9df60878f9081a8dfe5ee9de4f5954d989240826c2202571964f7d983", "epoch": 1603355397.863307, "event_time": "2020-10-22T08:29:57.863Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58218, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00923", "packet_number": 923, "byte_offset": 610733, "frame_sha256": "07e213a3b43bf402d83235e07a6b924c88402017a1b76e73fe8f4b0ecdc698a1", "epoch": 1603355397.895712, "event_time": "2020-10-22T08:29:57.895Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58224, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00935", "packet_number": 935, "byte_offset": 621453, "frame_sha256": "0cb2a09a2864c192c18f6cfc81a3ee0b259be71418fcb84a3af6175b4dfe6c4b", "epoch": 1603355397.930362, "event_time": "2020-10-22T08:29:57.930Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58225, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00941", "packet_number": 941, "byte_offset": 626932, "frame_sha256": "b7a966dc0dfcce9b64babebc3ac06a0ccd862478a1f6994dc9fa128297221e2f", "epoch": 1603355397.980164, "event_time": "2020-10-22T08:29:57.980Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58223, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00947", "packet_number": 947, "byte_offset": 631216, "frame_sha256": "a8e8219dcff36d4b39734255e0c19a8200190c2a48621129963fd21ddab6db56", "epoch": 1603355397.98247, "event_time": "2020-10-22T08:29:57.982Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58223, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00950", "packet_number": 950, "byte_offset": 633701, "frame_sha256": "944d3f3964b247f15b48eed0c0116db003b3fd4f2cf539a2a23f99f4392fdf53", "epoch": 1603355397.9835, "event_time": "2020-10-22T08:29:57.983Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58214, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00962", "packet_number": 962, "byte_offset": 644314, "frame_sha256": "f4525974595639c3822ff05fac79e128335dc0c40e45fb6217766c6a36539e9c", "epoch": 1603355397.999879, "event_time": "2020-10-22T08:29:57.999Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58226, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00968", "packet_number": 968, "byte_offset": 649850, "frame_sha256": "ea5949b472b2854cef15952ed825cb03d1945355e3f916e7277199b33568f6f2", "epoch": 1603355398.058245, "event_time": "2020-10-22T08:29:58.058Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58225, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00974", "packet_number": 974, "byte_offset": 654126, "frame_sha256": "28d229e31c2cd9543b9df30c5b733c7ad9c65983cbbde2cca0c6e9839ea53c84", "epoch": 1603355398.061539, "event_time": "2020-10-22T08:29:58.061Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58225, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00977", "packet_number": 977, "byte_offset": 656603, "frame_sha256": "9f44eff9ef4008c9604b9342d4666d2708563c5a6bd472ad719effd2a8651059", "epoch": 1603355398.063549, "event_time": "2020-10-22T08:29:58.063Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58215, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00989", "packet_number": 989, "byte_offset": 669084, "frame_sha256": "6d1f69a07cf614bf8faf2b4875839f4aac8dcfd475fc970a2f60f03b093dfbd6", "epoch": 1603355398.083033, "event_time": "2020-10-22T08:29:58.083Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58227, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P00995", "packet_number": 995, "byte_offset": 674002, "frame_sha256": "d4b2961932b0f8091fb9abc812e646e310775431518d6cb950e22d2802dd7dad", "epoch": 1603355398.960867, "event_time": "2020-10-22T08:29:58.960Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58227, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01002", "packet_number": 1002, "byte_offset": 680110, "frame_sha256": "36b4ef5f5ba8b2d620979ff52ffea5c7e468ebce4d7b6014780c1e200ef31ca5", "epoch": 1603355399.158514, "event_time": "2020-10-22T08:29:59.158Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58226, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01009", "packet_number": 1009, "byte_offset": 686226, "frame_sha256": "9286d037b6ecd852adf2f6f7158819c3ec9108ba2508b40d0b6fce408ef11930", "epoch": 1603355399.492179, "event_time": "2020-10-22T08:29:59.492Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58224, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01015", "packet_number": 1015, "byte_offset": 691042, "frame_sha256": "19879222d4c88fe9b5acf8649bc41e3de688757a6a91ec075f8de2db15835251", "epoch": 1603355399.957332, "event_time": "2020-10-22T08:29:59.957Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58226, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01019", "packet_number": 1019, "byte_offset": 695085, "frame_sha256": "8450645ff39bb7a3572ba0b8f436ba55abb10ea867330c0fc493174f407dd949", "epoch": 1603355399.96014, "event_time": "2020-10-22T08:29:59.960Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58226, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01029", "packet_number": 1029, "byte_offset": 704070, "frame_sha256": "24d791c615115e701779bc99d410c552d40a26bb8983bd5c1f3a941a23c03306", "epoch": 1603355399.963333, "event_time": "2020-10-22T08:29:59.963Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.7", "source_port": 58214, "destination_port": 5985, "captured_bytes": 351, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01039", "packet_number": 1039, "byte_offset": 709252, "frame_sha256": "a73a459973fddb0b76eaa6c7bb263bbdf208ecf22233a5663800a81522af5fd1", "epoch": 1603355400.191794, "event_time": "2020-10-22T08:30:00.191Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58227, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01045", "packet_number": 1045, "byte_offset": 714060, "frame_sha256": "dd3efc8300f4a54331bbe972af540921c10640872012bae1820f14aed84a4b41", "epoch": 1603355400.403298, "event_time": "2020-10-22T08:30:00.403Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58224, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01049", "packet_number": 1049, "byte_offset": 718103, "frame_sha256": "85073d13d56bd0057b490e1428a52ba6bffa5508813f4e4e30bdb706229ce25c", "epoch": 1603355400.405968, "event_time": "2020-10-22T08:30:00.405Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58224, "destination_port": 5985, "captured_bytes": 345, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01059", "packet_number": 1059, "byte_offset": 727088, "frame_sha256": "c2b21cbbbbda9f8159890979e81fbd02f80d50a53f50b39c5d0182ef7ebe2a22", "epoch": 1603355400.409334, "event_time": "2020-10-22T08:30:00.409Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.39.6", "source_port": 58218, "destination_port": 5985, "captured_bytes": 351, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01069", "packet_number": 1069, "byte_offset": 732296, "frame_sha256": "e3c999e45949b73a16d717f91c2d7f1b3c180d4343080ce7e34d316c7508a489", "epoch": 1603355401.164378, "event_time": "2020-10-22T08:30:01.164Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58227, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01073", "packet_number": 1073, "byte_offset": 736331, "frame_sha256": "55e653b206065bd20f5f4ed07e56a3aa0680aa365553ad16dcbc93c45ffc7123", "epoch": 1603355401.171357, "event_time": "2020-10-22T08:30:01.171Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58215, "destination_port": 5985, "captured_bytes": 341, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" }, { "id": "P01083", "packet_number": 1083, "byte_offset": 747180, "frame_sha256": "f64e9738526db1cf982f9531f58947f111a9a0680858dedce5aebdef04b067ba", "epoch": 1603355401.176632, "event_time": "2020-10-22T08:30:01.176Z", "protocol": "tcp", "source_ip": "172.18.39.5", "destination_ip": "172.18.38.5", "source_port": 58227, "destination_port": 5985, "captured_bytes": 347, "http_request": "POST /wsman?PSVersion=5.1.18362.1110 HTTP/1.1" } ], "signals": [ { "id": "ACCOUNT_SPRAY-1", "rule": "ACCOUNT_SPRAY", "phase": "spray", "title": "Distinct-account authentication failures", "record_ids": [ "H00788", "H00790", "H00792", "H00794", "H00796", "H00798", "H00803", "H00019" ], "event_time": "2020-10-22T08:29:53.000Z", "facts": { "host": "workstation5.theshire.local", "actor": "theshire.local\\pgustavo", "caller_pid": 7520, "distinct_accounts": 7, "failure_records": [ "H00788", "H00790", "H00792", "H00794", "H00796", "H00798", "H00803" ], "source_ip": null, "process_record": "H00019" }, "limits": "The 4625 records have no client IP. Caller host/PID/logon session links the failures; password reuse and recovery are not established." }, { "id": "RC4_SERVICE_BURST-2", "rule": "RC4_SERVICE_BURST", "phase": "tickets", "title": "RC4 service-ticket request burst", "record_ids": [ "H01125", "H01136", "H01140", "H01144", "H01148" ], "event_time": "2020-10-22T08:29:53.000Z", "facts": { "host": "mordordc.theshire.local", "actor": "theshire.local\\pgustavo", "client_ip": "172.18.39.5", "services": [ "defensesvc", "mordorsvc", "nxlogsvc", "otrsvc", "sysmonsvc" ] }, "limits": "A successful RC4 TGS request is not proof of password cracking. Legacy clients, services, and administration are competing explanations." }, { "id": "IPC_SHARE_CONTEXT-3", "rule": "IPC_SHARE_CONTEXT", "phase": "shares", "title": "IPC$ / srvsvc access across hosts", "record_ids": [ "H01198", "H01284", "H01324" ], "event_time": "2020-10-22T08:29:54.000Z", "facts": { "actor": "theshire.local\\pgustavo", "client_ip": "172.18.39.5", "hosts": [ "mordordc.theshire.local", "workstation6.theshire.local", "workstation7.theshire.local" ] }, "limits": "Share access checks provide discovery context; they do not prove file theft or reveal the full RPC operation." }, { "id": "REMOTE_POWERSHELL-4", "rule": "REMOTE_POWERSHELL", "phase": "remote", "title": "WinRM-hosted PowerShell on workstation6", "record_ids": [ "H03601", "H04447", "H02459", "H03882", "H00019", "H05038", "H05048" ], "event_time": "2020-10-22T08:29:57.967Z", "facts": { "host": "workstation6.theshire.local", "actor": "theshire.local\\pgustavo", "parent_record": "H03601", "child_record": "H04447", "auth_record": "H02459", "network_state": "corroborated", "network_records": [ "H03882", "H05038", "H05048" ], "packet_ids": [ "P00872", "P00884", "P00902", "P00908", "P00911", "P00923", "P01009", "P01045", "P01049", "P01059" ], "target_ips": [ "172.18.39.6" ] }, "limits": "Process GUID parentage and the target logon session are direct joins. Client traffic is associated by host/account, exact transport tuple, and time; no end-to-end WinRM request ID links a packet to a child process. Legitimate remote administration can produce the same pattern." }, { "id": "REMOTE_POWERSHELL-5", "rule": "REMOTE_POWERSHELL", "phase": "remote", "title": "WinRM-hosted PowerShell on workstation7", "record_ids": [ "H03833", "H04352", "H01310", "H02795", "H00019", "H05041", "H05058" ], "event_time": "2020-10-22T08:29:58.036Z", "facts": { "host": "workstation7.theshire.local", "actor": "theshire.local\\pgustavo", "parent_record": "H03833", "child_record": "H04352", "auth_record": "H01310", "network_state": "corroborated", "network_records": [ "H02795", "H05041", "H05058" ], "packet_ids": [ "P00839", "P00896", "P00941", "P00947", "P00950", "P00962", "P01002", "P01015", "P01019", "P01029" ], "target_ips": [ "172.18.39.7" ] }, "limits": "Process GUID parentage and the target logon session are direct joins. Client traffic is associated by host/account, exact transport tuple, and time; no end-to-end WinRM request ID links a packet to a child process. Legitimate remote administration can produce the same pattern." }, { "id": "REMOTE_POWERSHELL-6", "rule": "REMOTE_POWERSHELL", "phase": "remote", "title": "WinRM-hosted PowerShell on mordordc", "record_ids": [ "H23781", "H24051", "H02542", "H02800", "H00019", "H05052", "H05063" ], "event_time": "2020-10-22T08:29:58.095Z", "facts": { "host": "mordordc.theshire.local", "actor": "theshire.local\\pgustavo", "parent_record": "H23781", "child_record": "H24051", "auth_record": "H02542", "network_state": "corroborated", "network_records": [ "H02800", "H05052", "H05063" ], "packet_ids": [ "P00843", "P00935", "P00968", "P00974", "P00977", "P00989", "P00995", "P01039", "P01069", "P01073", "P01083" ], "target_ips": [ "172.18.38.5" ] }, "limits": "Process GUID parentage and the target logon session are direct joins. Client traffic is associated by host/account, exact transport tuple, and time; no end-to-end WinRM request ID links a packet to a child process. Legitimate remote administration can produce the same pattern." } ], "host_ip_observations": { "mordordc.theshire.local": [ "172.18.38.5" ], "workstation5.theshire.local": [ "172.18.39.5" ], "workstation6.theshire.local": [ "172.18.39.6" ], "workstation7.theshire.local": [ "172.18.39.7" ] }, "validation": { "status": "PASS", "oracle": "expected_findings.json", "failures": [], "limit": "Source-reference agreement on one recorded capture, not precision/recall or production validation." } }