All entitiesHunt
HostActive persistence mechanism
WS-FIN-004
First seen 9d ago · last seen 7d ago
Risk
72
Elevated
Observed activity
Latest 50 of 57 events
| Timestamp (UTC) | Severity | Event type | Message |
|---|---|---|---|
| Info | Authentication Success | Kerberos TGT issued for ekowalski from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for ekowalski from 10.4.12.25 (status 0x18: bad password) | |
| High | Persistence Created | Scheduled task "OneDriveSync" created to run downloaded payload every 30 minutes | |
| High | Process Execution | winword.exe spawned cmd.exe which invoked certutil to retrieve a remote file | |
| Info | Authentication Success | Kerberos TGT issued for kthompson from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for ivanov from 10.4.12.29 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for jmercier from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for ekowalski from 10.4.12.22 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for jmercier from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for cdiaz from 10.4.12.29 (status 0x18: bad password) | |
| Low | Authentication Failure | Pre-authentication failed for jmercier from 10.4.12.41 (status 0x18: bad password) | |
| Low | Authentication Failure | Pre-authentication failed for kthompson from 10.4.12.20 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for kthompson from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for ekowalski from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for ekowalski from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for awhitmore from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for lgarcia from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for cdiaz from 10.4.12.28 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for bpatel from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.30 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for ekowalski from 10.4.12.41 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for lgarcia from 10.4.12.32 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for ekowalski from 10.4.12.34 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for cdiaz from 10.4.12.25 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for dnakamura from 10.4.12.21 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for bpatel from 10.4.12.28 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for awhitmore from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for dnakamura from 10.4.12.20 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for bpatel from 10.4.12.38 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for ekowalski from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3) |
Profile
- Type
- Host
- Risk score
- 72
- Events
- 57
- Relationships
- 2
- First seen
- 2026-09-02 23:15Z
- Last seen
- 2026-09-04 17:47Z
Severity of associated events
- Critical0
- High2
- Medium0
- Low10
- Info45
Linked entities
Relationships derived from shared activity.