Aegis
All events
// Operations

Authentication Success

Kerberos TGT issued for ekowalski from 10.4.12.34 (logon type 3)

EVT-D2A1B6Info

Same principal

Other activity for ekowalski around this time

Hunt
TimeEventSeverityHost
2026-09-02 21:33:16ZAuthentication SuccessInfoWS-FIN-006
2026-09-02 22:02:26ZAuthentication SuccessInfoWS-FIN-006
2026-09-02 22:02:35ZAuthentication SuccessInfoWS-FIN-012
2026-09-02 22:17:47ZAuthentication SuccessInfoWS-FIN-011
2026-09-02 22:28:39ZAuthentication FailureLowWS-FIN-001

Same source address

Other activity from 10.4.12.34

TimeEventUserCountry
2026-09-02 21:07:23ZAuthentication FailureivanovUSA
2026-09-02 21:41:36ZAuthentication SuccesslgarciaUSA
2026-09-02 22:03:12ZAuthentication FailuregsimmonsUSA
2026-09-02 22:28:39ZAuthentication FailureekowalskiUSA

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_SUCCESS
Action
logon
Status
success
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.