// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical1
High3
Medium0
Low58
Info0

Applied filters

ip = 185.100.200.50

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 14:36:29Z	High	Process Execution	jsmith	185.100.200.50	Encoded PowerShell command block executed with hidden window and execution policy bypass
2026-09-04 14:33:29Z	Critical	User Created	jsmith	185.100.200.50	Account 'svc_helpdesk_tmp' created by jsmith and added to group 'Domain Admins'
2026-09-04 14:30:29Z	High	Mfa Method Removed	jsmith	185.100.200.50	Second-factor method 'Authenticator app' removed from account jsmith
2026-09-04 14:27:29Z	High	Authentication Success	jsmith	185.100.200.50	Kerberos TGT issued for jsmith from 185.100.200.50 (logon type 10, RDP) — prior successful logon for this account originated in Chicago, USA 41 minutes earlier
2026-09-04 14:26:53Z	Low	Authentication Failure	jmercier	185.100.200.50	Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:41Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:29Z	Low	Authentication Failure	hlindqvist	185.100.200.50	Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:17Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:05Z	Low	Authentication Failure	fokoye	185.100.200.50	Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:53Z	Low	Authentication Failure	ekowalski	185.100.200.50	Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:41Z	Low	Authentication Failure	dnakamura	185.100.200.50	Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:29Z	Low	Authentication Failure	cdiaz	185.100.200.50	Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:17Z	Low	Authentication Failure	bpatel	185.100.200.50	Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:05Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:53Z	Low	Authentication Failure	administrator	185.100.200.50	Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:41Z	Low	Authentication Failure	svc_sql	185.100.200.50	Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:29Z	Low	Authentication Failure	svc_backup	185.100.200.50	Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:17Z	Low	Authentication Failure	jsmith	185.100.200.50	Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:05Z	Low	Authentication Failure	lgarcia	185.100.200.50	Pre-authentication failed for lgarcia from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:53Z	Low	Authentication Failure	kthompson	185.100.200.50	Pre-authentication failed for kthompson from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:41Z	Low	Authentication Failure	jmercier	185.100.200.50	Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:29Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:17Z	Low	Authentication Failure	hlindqvist	185.100.200.50	Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:05Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:53Z	Low	Authentication Failure	fokoye	185.100.200.50	Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:41Z	Low	Authentication Failure	ekowalski	185.100.200.50	Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:29Z	Low	Authentication Failure	dnakamura	185.100.200.50	Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:17Z	Low	Authentication Failure	cdiaz	185.100.200.50	Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:05Z	Low	Authentication Failure	bpatel	185.100.200.50	Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:53Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:41Z	Low	Authentication Failure	administrator	185.100.200.50	Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:29Z	Low	Authentication Failure	svc_sql	185.100.200.50	Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:17Z	Low	Authentication Failure	svc_backup	185.100.200.50	Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:05Z	Low	Authentication Failure	jsmith	185.100.200.50	Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:20:53Z	Low	Authentication Failure	lgarcia	185.100.200.50	Pre-authentication failed for lgarcia from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:20:41Z	Low	Authentication Failure	kthompson	185.100.200.50	Pre-authentication failed for kthompson from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:20:29Z	Low	Authentication Failure	jmercier	185.100.200.50	Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:20:17Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:20:05Z	Low	Authentication Failure	hlindqvist	185.100.200.50	Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:19:53Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:19:41Z	Low	Authentication Failure	fokoye	185.100.200.50	Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:19:29Z	Low	Authentication Failure	ekowalski	185.100.200.50	Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:19:17Z	Low	Authentication Failure	dnakamura	185.100.200.50	Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:19:05Z	Low	Authentication Failure	cdiaz	185.100.200.50	Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:18:53Z	Low	Authentication Failure	bpatel	185.100.200.50	Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:18:41Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:18:29Z	Low	Authentication Failure	administrator	185.100.200.50	Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:18:17Z	Low	Authentication Failure	svc_sql	185.100.200.50	Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:18:05Z	Low	Authentication Failure	svc_backup	185.100.200.50	Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:17:53Z	Low	Authentication Failure	jsmith	185.100.200.50	Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:17:41Z	Low	Authentication Failure	lgarcia	185.100.200.50	Pre-authentication failed for lgarcia from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:17:29Z	Low	Authentication Failure	kthompson	185.100.200.50	Pre-authentication failed for kthompson from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:17:17Z	Low	Authentication Failure	jmercier	185.100.200.50	Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:17:05Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:16:53Z	Low	Authentication Failure	hlindqvist	185.100.200.50	Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:16:41Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:16:29Z	Low	Authentication Failure	fokoye	185.100.200.50	Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:16:17Z	Low	Authentication Failure	ekowalski	185.100.200.50	Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:16:05Z	Low	Authentication Failure	dnakamura	185.100.200.50	Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:15:53Z	Low	Authentication Failure	cdiaz	185.100.200.50	Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:15:41Z	Low	Authentication Failure	bpatel	185.100.200.50	Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:15:29Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)