One account. Three targets.
What connects the chain?
Trace an authentication burst through Kerberos, share access and remote PowerShell. Inspect the joins—and the gaps—between host records and packets.
25,993 host events · 1,121 packets · four hosts · six rule/context findings
Analyst brief
Independent analysis of OTRF’s recorded emulation · 22 October 2020
Assessment: investigate the connected activity; keep compromise unconfirmed. The records link authentication, service-ticket and share activity with remote PowerShell on three targets. Legitimate administration remains a competing explanation.
- Observed scope
THESHIRE\pgustavoon WORKSTATION5; target records on WORKSTATION6, WORKSTATION7 and MORDORDC. These are observed hosts, not a count of compromised systems.- Priority and impact
- Review warranted. Operational severity would depend on authorization and impact evidence; business impact is not established by this capture.
Key timeline
- Seven distinct-account failures share a caller host, PID and session. The failure records have no source IP.
- 08:29:53–54 UTCFive successful RC4 service-ticket requests and IPC$/srvsvc checks across three hosts.
- 08:29:57.967–58.095 UTCThree target PowerShell children have same-host parent-GUID and logon-session joins.
- The DC child is collected 39.812 seconds after execution. This is collection delay, not a second execution wave.
- Evidence strength
- Direct host GUID/session joins support execution. Matching packet tuples corroborate client flows; no end-to-end request ID proves packet-to-child causality.
- Recommended follow-up
- For an authorized follow-up, confirm operator/change approval, inspect full commands and script blocks, and seek identity/session and target-action evidence.
The investigation
I analyzed OTRF’s recorded PurpleSharp Active Directory emulation, built a reproducible Python analyzer, and tested detection logic against source records and counterexamples. The work links native process GUIDs and logon sessions to time-bounded network context.
The original capture was recorded by OTRF in 2020. This is my independent analysis of that public evidence, with the producer’s scenario notes kept separate from what the records establish.
Reconstruct the chain.
The replay displays the executed Python analysis. Select a phase, inspect its source fields, then compare the two clocks or the excluded ticket controls.
Scroll the timeline horizontally to compare UTC timestamps.
Seven distinct-account failures
Security 4625 records share a caller host, PID and logon session. Their source IP is missing.
Select a source reference
H00788–H00803: seven 4625 records. H00019: PurpleSharp.exe process anchor. Open the evidence JSON below for all field excerpts.
Preserve both clocks
Native Sysmon UtcTime and inferred-offset Security EventTime remain distinct from @timestamp collection time. The source inspector retains record numbers and original-line SHA-256 values.
Six findings support investigation. Intent, password cracking and compromise are not established.
Inspect detector logic and evidence boundaries
Failures: ≥5 distinct targets in 15 seconds, grouped by host/caller/PID/session. Tickets: ≥5 distinct successful RC4 services in 15 seconds. Shares provide context. Remote execution requires same-host parent GUID, account and session.
Security EventTime uses an inferred UTC−04:00 offset calibrated against 24 Sysmon process-start pairs. Security timestamps retain second precision. The PCAP parser inspects bounded headers and complete request lines in individual packets; it does not reassemble streams or decrypt content.
SPL and Sigma are unexecuted translations. The page reads the retained Python result; it does not run Splunk or a Sigma backend.
The strongest joins
On each target, Sysmon parent ProcessGuid identifies wsmprovhost.exe as the PowerShell parent. The account and logon ID also match the target’s Security 4624 type 3 logon. These direct host joins are stronger than matching a process name or PID alone.
Outgoing client Sysmon 3 events carry the original PurpleSharp ProcessGuid. Their exact TCP tuples match WSMan request packets. Target account, host and time associate that traffic with execution, but there is no end-to-end request ID proving which packet caused a particular PowerShell child.
Why collection time changes the story
The DC child executed at 08:29:58.095 UTC and was collected at 08:30:37.907 UTC: a 39.812-second delay. Switching clocks reveals how collection order can create a misleading second wave. Raw timestamps and the explicit conversion policy stay attached to every host excerpt.
Challenge the interpretation
Authorized WinRM administration produces the same parent/child tree. Legacy services can legitimately request RC4 tickets. The seven failures are local LogonType 2 events with no client IP; they support a distinct-account failure pattern, without proving a remote spray or a common password.
The analyzer retains twelve nonmatching ticket events. Tests change packet ports and remove target logons: execution findings remain, while full corroboration is withheld. These checks test the joins; one recorded emulation cannot establish enterprise precision, recall or a false-positive rate.
Inspect and reproduce
All 25,993 host records are counted; analysis selects 226 records from six event types. The network decoder accounts for all 1,121 packets, including 73 excluded records. Browser packet excerpts cover only the remote findings.
Reproduction commands
python -m unittest discover -s projects/08-ad-investigation -p 'test_*.py'
python projects/08-ad-investigation/analyze.py --source-dir /tmp/portfolio-ad-source --download --checkSource and scope
OTRF Security-Datasets / PurpleSharp AD Playbook I ↗, pinned to commit d9d40ef. Source excerpts are credited under the MIT license. This case demonstrates independent investigation and detection development on recorded emulation telemetry. It does not claim a production incident, an original owner-operated capture, or evidence of cracking, persistence or exfiltration.