Aegis
All events
// Operations

Authentication Success

Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3)

EVT-4B9BB7Info

Same principal

Other activity for gsimmons around this time

Hunt
TimeEventSeverityHost
2026-09-03 15:58:07ZAuthentication SuccessInfoWS-FIN-008
2026-09-03 16:13:17ZAuthentication SuccessInfoWS-FIN-006
2026-09-03 17:02:03ZAuthentication FailureLowWS-FIN-010
2026-09-03 17:05:16ZAuthentication SuccessInfoWS-FIN-011
2026-09-03 17:05:18ZAuthentication SuccessInfoWS-FIN-010
2026-09-03 17:34:23ZAuthentication SuccessInfoWS-FIN-001

Same source address

Other activity from 10.4.12.34

TimeEventUserCountry
2026-09-03 16:20:00ZAuthentication SuccesshlindqvistUSA
2026-09-03 16:51:11ZAuthentication SuccesskthompsonUSA
2026-09-03 17:01:58ZAuthentication SuccesslgarciaUSA

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_SUCCESS
Action
logon
Status
success
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.