// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
63
events match
Severity
- Critical2
- High3
- Medium0
- Low58
- Info0
Applied filters
- host = WIN-DC01
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Critical | Credential Access | jsmith | — | Process memory of lsass.exe dumped to disk via comsvcs.dll MiniDump | |
| High | Process Execution | jsmith | 185.100.200.50 | Encoded PowerShell command block executed with hidden window and execution policy bypass | |
| Critical | User Created | jsmith | 185.100.200.50 | Account 'svc_helpdesk_tmp' created by jsmith and added to group 'Domain Admins' | |
| High | Mfa Method Removed | jsmith | 185.100.200.50 | Second-factor method 'Authenticator app' removed from account jsmith | |
| High | Authentication Success | jsmith | 185.100.200.50 | Kerberos TGT issued for jsmith from 185.100.200.50 (logon type 10, RDP) — prior successful logon for this account originated in Chicago, USA 41 minutes earlier | |
| Low | Authentication Failure | jmercier | 185.100.200.50 | Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ivanov | 185.100.200.50 | Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | gsimmons | 185.100.200.50 | Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | fokoye | 185.100.200.50 | Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ekowalski | 185.100.200.50 | Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | dnakamura | 185.100.200.50 | Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | cdiaz | 185.100.200.50 | Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | bpatel | 185.100.200.50 | Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | awhitmore | 185.100.200.50 | Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | administrator | 185.100.200.50 | Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | svc_sql | 185.100.200.50 | Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | svc_backup | 185.100.200.50 | Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | jsmith | 185.100.200.50 | Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | lgarcia | 185.100.200.50 | Pre-authentication failed for lgarcia from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | kthompson | 185.100.200.50 | Pre-authentication failed for kthompson from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | jmercier | 185.100.200.50 | Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ivanov | 185.100.200.50 | Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | gsimmons | 185.100.200.50 | Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | fokoye | 185.100.200.50 | Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ekowalski | 185.100.200.50 | Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | dnakamura | 185.100.200.50 | Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | cdiaz | 185.100.200.50 | Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | bpatel | 185.100.200.50 | Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | awhitmore | 185.100.200.50 | Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | administrator | 185.100.200.50 | Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | svc_sql | 185.100.200.50 | Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | svc_backup | 185.100.200.50 | Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | jsmith | 185.100.200.50 | Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | lgarcia | 185.100.200.50 | Pre-authentication failed for lgarcia from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | kthompson | 185.100.200.50 | Pre-authentication failed for kthompson from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | jmercier | 185.100.200.50 | Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ivanov | 185.100.200.50 | Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | gsimmons | 185.100.200.50 | Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | fokoye | 185.100.200.50 | Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ekowalski | 185.100.200.50 | Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | dnakamura | 185.100.200.50 | Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | cdiaz | 185.100.200.50 | Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | bpatel | 185.100.200.50 | Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | awhitmore | 185.100.200.50 | Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | administrator | 185.100.200.50 | Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | svc_sql | 185.100.200.50 | Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | svc_backup | 185.100.200.50 | Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | jsmith | 185.100.200.50 | Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | lgarcia | 185.100.200.50 | Pre-authentication failed for lgarcia from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | kthompson | 185.100.200.50 | Pre-authentication failed for kthompson from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | jmercier | 185.100.200.50 | Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ivanov | 185.100.200.50 | Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | gsimmons | 185.100.200.50 | Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | fokoye | 185.100.200.50 | Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | ekowalski | 185.100.200.50 | Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | dnakamura | 185.100.200.50 | Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | cdiaz | 185.100.200.50 | Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | bpatel | 185.100.200.50 | Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | awhitmore | 185.100.200.50 | Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password) |